3D Secure Auth Page

3D Secure Auth

Written by ABPAY

3D Secure enables the consumers to enter a password to confirm their identity with the card issuer. If accepted, the consumer can then complete their order and once received by the merchant, the merchant has more confidence that the transaction is genuine and not fraud.

The 3D Secure protocol was developed by Visa to improve the security of Internet payments. The protocol is offered with the service name Verified by Visa. MasterCard has also adapted a similar protocol called MasterCard SecureCode. Both are designed to allow authentication of cardholders by their Issuers at participating merchants.

3D Secure Process

The process of 3D Secure is real simple and straight forward. Below demonstrates the steps required in order to successfully cater for 3D Secure.

1. Sale request returns with 01 which indicates you must cater for 3D Secure as failure will decline the transaction.
2. Using the ACSURL, PAReq & the TermURL, you must now construct a HTML Form containing the mentioned information and have the form automatically submit on page load.
3. This form will submit the data and load the required 3D Secure page where the consumer must enter their unique secure code and submit in order to authenticate themselves.
4. The form will then redirect the consumer to your TermURL where the merchant will have their 3D Secure Confirm API setup to confirm that the consumer has passed authentication.
5. The response from the 3D Secure Confirm API within your TermURL will respond with the usual error code / description result that would normally determine a successful or declined transaction. Please read the Sale documentation about the potential error code & descriptions that are available.

Catering 3D Secure

When a card is 3D secure, you must load a form inside an iFrame which will be the 3D Secure handler. You must construct the form with the required values outlined below which must be automatically submitted to the authenticator URL inserted in the form's action attribute. You must construct the form, populated with the values received in the Sale Response.

Sample 3D Secure Form

<!DOCTYPE html>									
<html>									
    <head>									
        <meta charset="UTF-8">									
        <title></title>									
    </head>									
    									
    <body onload="document.frm3d.submit();">									
        <form name="frm3d" action="ACSURL Value" method="post">									
      <input type="hidden" name="PaReq" value="PaReq Value" /> 									
      <input type="hidden" name="TermUrl" value="TermURL" />									
      <input type="hidden" name="MD" value="MD Value" />									
        </form>									
    </body>									
</html>

3D Secure Process
The process of 3D Secure is real simple and straight forward. Below demonstrates the steps required in order to successfully cater for 3D Secure.

Catering 3D Secure

You must construct the form, populated with the values received in the Sale Response."

Sample 3D Secure Form

<!DOCTYPE html>									
<html>									
    <head>									
        <meta charset="UTF-8">									
        <title></title>									
    </head>									
    									
    <body onload="document.frm3d.submit();">									
        <form name="frm3d" action="ACSURL Value" method="post">									
      <input type="hidden" name="PaReq" value="PaReq Value" /> 									
      <input type="hidden" name="TermUrl" value="TermURL" />									
      <input type="hidden" name="MD" value="MD Value" />									
        </form>									
    </body>									
</html>

If the entered card is 3D Secure and the sale request is successful, the errorcode field inside the JSON document will contain "01" as the error code. The following information will also be made available in data field:

- AC-SUR-L will be included in the R3 field which is used to redirect the customer to the 3D Secure service.
- PAReq is a message passed to the Issuing Bank as part of the process where the card holder can identify themselves. You can retrieve the PaReq value from the <R4> field and then pass it onwards to the authenticator.
- MD is a secret key between the Issuer, acquirer and the merchant.
- TermURL is the URL configured to receive the consumer returning from completing authentication. This URL was set in the initial sale request. Responses from the authentication service will also be sent to this URL.

The PaRes will be returned to the TermURL page. The PaRes value returned should then be passed into the PARes field of the 3D Secure Confirm request.