Protx.com down - solutions thread

what to do when a payment gateway goes down

[jaski]

DDOS attacks are a reality of life. So what all can webstore owners do to minimise risk?

I will just quickly go through what we have done. We have integrated 2 payment gateways, Protx and Worldpay to our webstore. It has been created in such a way that we have an admin script to manually switch between the two .. so that we can easily switch over when one trips. Still, it is not the ideal solution. It does not work if an attack starts in the middle of the night when I am sleeping :)

One solution is to put both buttons on the checkout page, and let the buyer choose. So if one does not work, he will use the other.

But ideally we would like people to use protx when it is working .. and worldpay only when protx is not working. So I am looking for a way to automate the protx to worldpay switch.

What are others doing?

[Phil_C]

Protx are driving me nuts at the moment (not their fault I know).

A realtively simple method is within your code, before the payment step, attempt a HTTP GET request of their URL, i.e. http://www.protx.com/. If there are no errors, then proceed to that payment provider, otherwise check the other one. Failing that one, tell them you have their order details and will call you when the office is open.

I've been meaning to code this in for a while, but it's only when you get problems like this you remember the importance of it!

[edited by: lorax at 8:40 pm (utc) on April 23, 2005]

[Essex_boy]

PhilC thats a very good idea

[Receptional]

It's getting a menace! And now we hear there are ransom demands from Russia! yeh - like they'll be able to pay that after 40 staff and Hitech crime personel are working on it day after day.

I set up a paypal account a while back, linked into Mals-e. I switched it off as it was a bit confusing on the screen, but I think I will switch it back on while the DOS is still running...

I hadn't thought about that until I sawe this thread, but it seems a simple solution.

[ajparty]

Just asking for protx.com is not enough (in my experience). Sometimes you'll get the site, but your IP address will be being blocked; sometimes you'll get a 'timed out' response back from Protx (not an HTTP response).

Here's some pseudo-code I use - it's in VB so should be easy enough to transport to any solution. It will try three times to connect to Protx. Even when Protx is up and running normally, it's not uncommon for the connection only to go through on the second attempt.

[pre]
  Dim tx As New Protx.Vsp.VspDirectTransaction(VendorTxCode, Protx.Vsp.VspTransactionType.Payment)
  '... fill in your tx details here
  Do Until CurrentAttempts > 3
   CurrentAttempts += 1
   Try
    vspResponse = tx.Send
    If Not (vspResponse.StatusDetail.ToLower.Contains("timed out")) Then
     Exit Do
    End If
   Catch ex As Exception
    ' this will only happen if we can't connect at all
    OrderStatus = "Connection failure - Protx not responding"
   End Try
  Loop
  ' vspResponse will only be nothing if we've had a pretty catastrophic failure
  If vspResponse IsNot Nothing Then
   OrderStatus = vspResponse.Status.ToString()
   If vspResponse.Status = Protx.Vsp.VspStatusType.OK Then
    ' the Protx thing is all OK - write your order to the db...
    CompleteOrder()
   End If
  End If
  Return OrderStatus
[/pre]

[EstoreSeeker]

There will be some development required, depending on how your software is written, you will develop a common interface between your application and the payment Protx and Worldpay, the application will talk to the common interface which will be smart retry the transaction if one of them is down.

ESS.

[jaski]

I forgot to mention one thing. It was that there are two types of payment gateway integrations. So I will just add that to avoid confusion.

1) Type1 - where you send the customer to third party payment gateway's server .. and after the payment is authorised or declined, you get a callback to the handling script on your server.

2) Type2 - where customer stays on your website throughout the course of the transaction and credit card info is submitted to your server which in turn authorises it using payment gateway server.

The problem is due to same reason in both the cases, but solutions will be slightly different. I feel its easier to solve Type2 than Type1 because in Type2 you do all the stuff on server side .. and there is no risk of time outs for the customers.

In Type1 it is a two step process where you send a page with payment button first .. and then user clicks it .. and goes to the Protx or any other payment gateway page and there he gives his credit card number.

My understanding of the solutions given above is :

What EstoreSeeker has given is a good solution for Type2. Ajparty's solution is also valid for Type2. What Phil_C has mentioned can be used for both, though I have not tested it so I cannot comment on its reliability, but would love to hear from those who have tried that.