Is it correct to implement all the payment flow in the client rather than in the server?

Question

I’m building a mobile app marketplace and I came to the point of integrating a payment tool. I'm using Mangopay, which has a nice workflow for making payments in a marketplace using its REST api. The question is: is it correct to implement all the workflow and the interactions in the mobile app, or should I implement it in my server? I would like to listen for the pros and cons of the two approaches, thanks!

Answer 1

I Haven't used mango pay but usualy these things work in three parts:

1. client redirects user to third party payment app. eg paypal or 3d secure
2. third party tells client payment has been made
3. third party tells merchant they have been paid (via an unrelated server)
4. server completes the transaction, eg. ships the goods, unlocks the download
5. client checks status with server

So you can see that the third party requires that you have a service somewhere for it to send you the 'money received' message. Normally you give them a url to which they POST a predefined message, xml or json, or they have a website you can log into and check.

You could easily trust the third party message to the client, but this would leave you open to that message being changed or faked. Say I change my network dns to send pay-pal requests to my own server, where I fake a 'successful payment' return message.