Bugs

Topic for reporting any problems and bugs.

IMPORTANT NOTE: There is a known issues with installing new plugins in nopCommerce.
Please read this post for more information.

I have a strange issue: the first callback from Stripe via webhook fails with an error 400, but the retry some minutes later succeeds. This seems to happen systematically.

Erfolgreich (Succeeded)
payment_intent.succeeded
evt_1FIrVXBhgWLqNFa0K39jxxxx
15.09.19, 09:16

Fehlgeschlagen (Failed)
payment_intent.succeeded
evt_1FIrVXBhgWLqNFa0K39jxxxx
15.09.19, 08:46

Erfolgreich (Succeeded)
payment_intent.succeeded
evt_1FIM8aBhgWLqNFa0YsYvxxxx
13.09.19, 23:47

Fehlgeschlagen (Failed)
payment_intent.succeeded
evt_1FIM8aBhgWLqNFa0YsYvxxxx
13.09.19, 23:17

The payment module is set to "authorize and capture" mode if this matters.

It's good.


Customer did a payment and Stripe sent a webhook at once, but customer didn't do nop order (didn't press the button 'Confirm order').
Plugin sends 'error' to webhook. After Stripe will send new webhook after 3-5 minutes.
Customer pressed 'confirm order'.
Stripe sends webhook again. Plugin changes the payment status order.

Support wrote:
Thanks for the reply.

I'm however not sure how this can be right. This would mean that your plugin actually captures the money before the order has been submitted? What if the customer doesn't order in the end - doesn't the money remain captured? Note that the delay between retries is much longer, and they show up as "50% error rate" in the stripe console, I don't think this can be by design?

I've been using the Stripe plugin from nopCommerceplus.com previously without such a problem, but since I had to update the plugin anyways due to the SCA enforcement I decided to switch to yours because your plugins are usually of high quality with proper localization support etc.

I understand you. My plugin used the old Stripe API too.
Old Stripe API has another logic.
When customer did a payment after it we got a "token" and we submitted payment using this token "token"  after  nop order was created. Most of payment methods use this algorithm.

1. Don't confuse "Capture and Confirm" in Stripe words.
New Stripe API supports two modes 'Authorize' and 'Authorize and Capture'.

What does it 'Confirm'?
2. When customer pressed the button 'Submit payment' after it Stripe saved this credit card into internal storage.
Next step. Plugin sent command 'Confirm payment' - (it's not a confirm nop order!!!).
After it you can see this payment in the Stripe Dashboard with status "Unfinished".
Stripe checked the credit card and Stripe saw 3D Secure.
Stripe JS library will show the popup window. Customer needs to set secured code.
After it Stripe changes the payment status with new value Charged or Authorize.

and customer will go to the next step - nop checkout confirm page.

I speak with Stripe how you disable automatic charging of payment in the new API.

Support wrote:
Great, waiting to hear your feedback.

Just a mitigation idea though, when in the "Authorize and Capture" mode you could use the Stipe API in the Authorize mode and automatically capture the money upon NOP order completion with a separate API call?

>"Authorize and Capture" mode you could use the Stipe API in the Authorize mode and automatically capture the money upon NOP order completion with a separate API call?

It's one of solution. I thought about it too.

To use method 'Capture' when customer pressed the button 'Confirm Order'.
I thought about it.

But we have the problem.
When customer didn't press the button 'Confirm Order' the money will be locked on customer's credit card 7 days. We need to do Void for such unconfirmed order.

But it's a solution too.
I want to get answer from Stripe support.

Support wrote:
If a user goes this far in the checkout and does not press "Order", I think this is acceptable because he might have left the browser open and complete the checkout any time later. I'm not aware of a way I can abort an order at this stage in NOP as a customer other than by not confirming the order. It would certainly be better than having captured the money already, which would make me very upset as a customer!

That being said, if the user goes through the checkout a second time (for instance by going back to the cart) it would be nice if the amount authorized on the first checkout would be canceled, but even that does not seem like a big issue to me.

I agree with you.
Stripe answered that  Payment is the last step in checkout.
I didn't get answer from Stripe about possible usign 2 steps of payment process yet.

I saw only two solution.
1. Move the step with payment info (credit card) to the last  step "after confirm order".
Customer pressed the button 'Confirm order' and plugin showed customer the new page with credit card fields.

2. When customer pressed 'Submit payment' than plugin created the nop order.
We skip the nopcommerce last 'Confirm order' step.

But I want to get official answer.
This Stripe API is the new...

I am currently testing the plugin and I have the same issue. As of my opinion the only correct way is to authorize before nopcommerce order confirmation and to charge after nop commerce order confirmation.

If you do it the way, you do it today, you get a problem when the customer confirms his order, but an item is no more available, because another customer has bought the last one meanwhile. In this case, nopcommerce acts correctly by not creating the order and sending a warning message, but the amount is already changed by the plugin.

If you do it the way you suggested (paying info after order confirm) then the customer can produce an order and then cancel the payment process, so the order has been produced by nopcommerce, but there is no payment. Also putting the payment info after the order confirmation is very unusual and maybe even not allowed in EU.

Could you find a solution to first authorize and then charge?

>As of my opinion the only correct way is to authorize before nopcommerce order confirmation and to charge after nop commerce order confirmation.

You are right, but Stripe has other logic. Other payment services use your logic,
but not Stripe.
When customer creates payment than Stripe wants to validate 3D Secure 2.0 using popup window. After confirmation 3D Secure 2.0 stripe creates payment at once.
Plugin can't confirm payment  itself. Only customer can do it from his browser.
Payment plugin from other vendors do the payment from payment info checkout step. If customer  doesn't press the button "Confirm order" at the last nopcommerce checkout step than customer did a payment but nopcommerce didn't create nop order. It's a very big problem.

I implemented the new logic in my plugin. Customer create payments at the nopcommerce  payment info checkout step and confirm this payment before customer presses the button "Confirm order" at the last nop checkout step.

You want to validate order before customer creates the nop order.
I can't do it in this Stripe logic of payment workflow.
The problem is in Stripe confirmation step for 3D Secure 2.0.



If you do it the way, you do it today, you get a problem when the customer confirms his order, but an item is no more available, because another customer has bought the last one meanwhile. In this case, nopcommerce acts correctly by not creating the order and sending a warning message, but the amount is already changed by the plugin.

If you do it the way you suggested (paying info after order confirm) then the customer can produce an order and then cancel the payment process, so the order has been produced by nopcommerce, but there is no payment. Also putting the payment info after the order confirmation is very unusual and maybe even not allowed in EU.

Could you find a solution to first authorize and then charge?

Ok, I anderstand.

So why not then do the following process:

1. When customer enters credit card info, just do basic plausibility tests on the entered data (checksum, etc.)
2. Let the customer confirm the order.
3. If everything is ok, charge the credit card and let stripe popup its 3d secure window.
4. if user aborts, keep order as unpaid
5. if user finishes, set order state as paid.

What do you think?

>3. If everything is ok, charge the credit card and let stripe popup its 3d secure window.

This step will be on the new HTML page.

ah, so it is not possible to stay on the current page and wait for the pop to end?

>ah, so it is not possible to stay on the current page and wait for the pop to end?

No, it will be very custom solution.