1

I’m building a mobile app marketplace and I came to the point of integrating a payment tool. I'm using Mangopay, which has a nice workflow for making payments in a marketplace using its REST api. The question is: is it correct to implement all the workflow and the interactions in the mobile app, or should I implement it in my server? I would like to listen for the pros and cons of the two approaches, thanks!

  • 6
    If by "implement the payment workflow in the app" you mean that your server accepts the word of the app that a payment has been made, then HELL, NO! Code not running under your control can never be trusted to tell the truth. – Kilian Foth Oct 14 '15 at 14:56
4

I Haven't used mango pay but usualy these things work in three parts:

  1. client redirects user to third party payment app. eg paypal or 3d secure
  2. third party tells client payment has been made
  3. third party tells merchant they have been paid (via an unrelated server)
  4. server completes the transaction, eg. ships the goods, unlocks the download
  5. client checks status with server

So you can see that the third party requires that you have a service somewhere for it to send you the 'money received' message. Normally you give them a url to which they POST a predefined message, xml or json, or they have a website you can log into and check.

You could easily trust the third party message to the client, but this would leave you open to that message being changed or faked. Say I change my network dns to send pay-pal requests to my own server, where I fake a 'successful payment' return message.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.