Ecommerce Flow

[will1480]

is this how ecommerce would flow through my site:

I still trying to figure all this out still. I dont see how the flow works. First I host with SSL support

my CC form on https page --> post to CC processing (use my SSL certificate) outside my domain to CC processor, another https page --> CC gateway processes transaction outside my domain --> CC posts good/bad transaction variables to https PHP page within my domain --> I send client to a http page with good/bad message

[YourVirtualStore]

There are 2 ways you can use credit card processing.

Firstly you can simply use a gateway provider that processes the customers card on their site. No SSL is required.

So customer ads item to cart - http >
sent to cc processor/gateway - https>
enters details on gateway site - https>
sent back to your site with a success or fail message - http

This is the simplest way of doing it as all validation and storing of card data is done on the gateway side of things.

Second method is to take the details on your site and have the transaction processed i nthe background with the customer never leaving your environment.

Customer ads item to cart - http >
Sent to your cc page to insert card details - https>
- (background) CC details sent to cc processor/gateway in background - https>
- (background) Processor sends back an accept or fail message to your site - https >
If success your site renders the thank you page in either SSL or not depending upon the level of detial you will be displaying >
If fail then customer sent back to cc page in SSL - https

For example our system works by the gateway sending back to a hidden page that processes the info and then if ok pushes off to the thank you page and if not ok sends back to the cc page.

Hope this helps,
Cam

[will1480]

Thank you very much. That is what I thought was going on. I am just very new to SSL and am trying to get caught up real quick. Is there any serious security concerns I need to be careful of, even using SSL? Once again thank you.

[YourVirtualStore]

Biggest issue is do NOT store credit card numbers on your site. That is why it is best to sometimes use a reputable third party to process your customers card details.

A lot of banks will not allow you to accept cards as well if you store them in your db.

Hackers are keen and eager to get in and not even the most secure system is safe so be careful.

Cheers,
Cam

[will1480]

Yeah, I have no care with holding their credit card numbers. Our bigger clients who login will simply be sent an invoice. Holding their card info would be a risk for our clients that I dont want to take. You have been very helpful :)