0

I’m building a payment system for some ebooks with Reactjs on the frontend, Firebase as hosting and database and cloud functions at the backend side. Customers don’t need an account to buy ebooks so they are not logged in or getting an account.

At this point I’ve got a form for their firstname, lastname and email and a hidden field with the ebook they want to buy. This is the first step. After submitting the form I’m checking if everything is valid. When everything is valid I want to send the data to the server. I want to check the data there as well (you never know if somebody is changing the fronted code). When the server check is done and valid, a push to the database has to be made. At this point, a new entry is made with a unique key. All the time, the user is on a redirected page (something like www.mydomain.com/addNewCustomerInformation (to send information to my server) (Note: the url is a redirect from https://us-central1-<projectname>.cloudfunctions.net/addNewCustomerInformation)) with a loading icon.

Now that the basic information is known and put in the database another redirect takes place to send the user to a confirmation page. First the user has to check if the information is correct, secondly he has to choose a payment option (I’m using Stripe). The options are Alipay, iDeal, bancontact, bitcoin and credit card. So I’m having a more complex system than examples that are only using credit card. Because there are some examples for credit cards, I will go on for iDeal.

When the user has checked his information (It’s not with a confirm button. You can edit your information if there was something wrong.) and clicked on the iDeal button a Stripe source needs to be made and with a redirect the user will be guided through the iDeal steps. The payment part already works so I will skip this. After the payment, the user gets a mail with a 72h link to download the ordered eBook. This is for security sharing reasons. After 72h the link needs to expire (how can I do this?).

So here are my questions:

1) The part were I redirect the user to another url so I can do a post to my server (webhooks), let them wait with a loading icon and do another redirect when I’m getting data back from the server looks very unclean to me. What is a better way to do this?

2) How can I make the url expire after 72h? (so, how can I make the unique id that’s in the database expire after 72h)

Improve this question
5
  • 1
    1. What do you mean by "better?" Questions that include words like "better," "best practice" and "unclean" are unanswerable unless you can articulate what, specifically, you mean by those terms.
    – Robert Harvey
    Jul 29, 2017 at 22:28
  • 1
    See also stackoverflow.com/questions/18038541/…
    – Robert Harvey
    Jul 29, 2017 at 23:08
  • @RobertHarvey Well, the way I should do it is with two redirects. I've never experienced it this way when I'm buying something on websites so in my opinion there must be a different way to handle this kind of actions. To make it very specifically, how can I make a post call after I have validate the form data from my user to a webhook and receive data without redirecting my user to the webhook url.
    – Thore
    Jul 29, 2017 at 23:22
  • How much time do you need to verify that the provided information is correct? Do you really need so much time that it makes sense to show a "please wait" screen?
    – Bart van Ingen Schenau
    Jul 30, 2017 at 6:51
  • @BartvanIngenSchenau Depends on how fast the internet connection and server is. For me it only takes a few milliseconds - 1 second but people with an average/bad connection or for mobile users it can take a bit longer.
    – Thore
    Jul 30, 2017 at 15:29

1 Answer 1

Reset to default
1

1) You don't really need the redirect. Have the client do an ajax post to an api.

2) Add OrderDate time to the row. when the download link is requested, check that the current time is less than 72h later than the order time.

The order link can be to a server side generated page. just set the mine type appropriately so the browser downloads a file rather than trying to render html.

re:security with no login.

If you think about it you have the users email address and can send them a link. So you do have a way to verify the user.

Instead of a 72h time limit you could send them a 1 use link. the server side code would mark it used when it is served.

Or, you could implement a login where instead of requesting a password, it emailed a similar one use random link to the user. Essentially they are resetting their password every time they login.

This would allow you to implement a previous order area which they could use to redownload their purchases.

Or you could email them the book...

Improve this answer
2
  • Thanks for your answer. Since this morning I'm using the Fetch api to make a post request so the first problem is solved. For the second part. We have considered sending the book but there are also packages with audio files and all together it's more than 25mb (the maximum size for attachments we can send) so it has to be done with a download link. The solution with the 1 use link seems something good. To verify the user's email, should I make a url with an unique id (the unique payment id) and the email in the querystring? And check this data with a get?
    – Thore
    Jul 30, 2017 at 15:44
  • no you need to generate random urls. downloadbook?r=hddidndkkshaosndhdh which respond with the book on the first request and 'sorry this link has been used' on the second
    – Ewan
    Jul 30, 2017 at 16:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.