I recently had to implement the 3D Secure payment system.
In order to do this 3 fields must be sent to the 3D Secure ACS (Access Control Server)
- MD
- Term Url
- PaReq (Payer authentication request)
Initally everything went well until we tested our pages in Google Chrome and Safari. Under both browsers the 3D Secure inline frame displayed the following message
“Error decoding PAREQ message”
A support page mentions that a PaReq contains newlines and that if any of these are missing the PaReq decoding will fail. The page also mentions that there are issues with Chrome and Safari but provides no solution.
So what is the problem?
The problem is indeed the newline.
In our markup we use and EL (Expression Language) to output the PaReq e.g.
<input type="hidden" name="PaReq" value="#{paReq}" />
If the PaReq returned a string such as
"I am The PaReq "
Note the quotes above mark the begining and end of the string. The string itself is terminated by a newline, in code it would be:
String paReq = "I am\nThe PaReq\n";
The browser should generate the following markup
<input type="hidden" name="PaReq" value="I am The PaReq " />
However Chrome and Safari generate the following markup (as both browsers do this I assume its a Webkit thing)
<input type="hidden" name="PaReq" value="I am The PaReq" />
Note, the traililng newline has disappeared and herein lies the problem, the server fails to recoginse the PaReq as the trailing newline has gone (currently Chrome 4.0.429.89 contains the above bug).
The fix? Dont use Chrome or Safari, Only kidding
The way we overcame this was to use a “hidden” textarea
<textarea name="PaReq" style="display:none">#{paReq}</textarea>
Which renders
<textarea name="PaReq" style="display:none">I am The PaReq </textarea>
In all browsers and preserves the trailing newline. The style=”display:none” hides the textarea. Although this is crude it does provide a fix for Chrome and Safari.
