Expresso Store: "Card details must be submitted over a secure connection" error

Question

I am trying to checkout with the Dummy Payment Gateway in Store. It will not let me do this. The error message says "Card details must be submitted over a secure connection."

I have Expression Engine (2.5.5) installed on my local server WAMPserver(2.2) and am using Expresso Store(1.6.2).

I'm not sure of what direction to go with fixing this. I want to simply checkout with the dummy information and get a successful payment page for testing purposes. I want all this to be done locally. I've read some very technical tutorials on enabling SSL in WAMPserver, that is if that is the answer to making this work. I'm hoping there is an easier solution than that. I am very open to the best way to solve this. When live, I will be using PayPal to process payments. I guess my last option would be to create a Paypal Sandbox account for testing purposes. In this scenario, I'm assuming the order would leave my site and wouldn't have to be encrypted since the billing information will only be processed on Paypal.

Any suggestions, help, or ideas are greatly appreciated.

Shannon

Answer 1

This is a hard coded requirement in Store. We do not allow credit card details to be submitted over an unsecure (HTTP) connection, period. If we had a setting to disable this, it would be far too easy to forget to re-enable it when you move to production (or every time you push to production if you're using multiple environments). Then aside from breaking the Payment Card Industry requirements, you run the risk of your customers' credit card details being stolen by the person sitting next to them in a cafe, or worse.

If you are going to be using SSL in production, you should set up your development environment with SSL as well. This means your development environment is as close to production as possible, and it also means you can test things like your htaccess redirects between HTTP and HTTPS pages.

If you are going to be using PayPal Express (or another off-site payment gateway) when you go live, then you will not be submitting credit card details directly to your site, so there is no need to test with the Dummy gateway. You should take a look at the Manual payment gateway which will simply authorize every transaction without requiring card details (it's normally used for check/bank transfer payments, but it's also good for testing your checkout process sans payment).

Answer 2

I'm having the same issue, even though I've set PayFlow Pro to Test mode. I'm surprised any non PHP experienced developer can figure this out. I only did after digging through the code and dumping the responses at several points in the checkout process. It also does not let you use a test CC number. For example 411111111111 is a common test number that all CC companies recognize, but Store says its invalid.

I recommend reconsidering this "feature" - If the payment gateway is in test mode, then it should be submitting to a test server, so it does not matter what the CC # is or if its a secure request. Its actually more of a security risk to require me to comment out code to test locally (even our dev server doesn't have SSL certs on it) then hope I remember to uncomment it out before going to production. Magento uses test modes in a similar fashion, why can't Store?

I would also recommend more robust logging... as it stands right now the only way for a non-PHP developer to figure out what is going on is to var_dump all over the code base. Even an experienced PHP developer should be able to view a log of what is happening. I actually have an easier time debugging Magento errors than I do Store :(

Answer 3

Let me start off by saying I fully support not allowing even test transactions with an on-site gateway (even the dummy gateway) to be processed over HTTP as it is a security risk to you and your customers if you forgot to enable HTTPS/SSL before the site goes live.

If you are on a local environment and you can not enable HTTPS for various reasons there is an option that you can do but it requires a core hack to Store and should never be done on a live site.

If you open up store/ci-merchant/libraries/merchant.php you can scroll down to about line 624 where you should see the following code block:

/**
 * Returns TRUE if the current request was made using HTTPS
 */
protected function secure_request()
{
    if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) AND $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https')
    {
        return TRUE;
    }
    if (empty($_SERVER['HTTPS']) OR strtolower($_SERVER['HTTPS']) == 'off')
    {
        return FALSE;
    }

    return TRUE;
}

The conditional on line 633:

if (empty($_SERVER['HTTPS']) OR strtolower($_SERVER['HTTPS']) == 'off')

is returning FALSE causing the error to be shown if you modify the code block to the following you should be able to checkout over HTTP:

/**
 * Returns TRUE if the current request was made using HTTPS
 */
protected function secure_request()
{
    if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) AND $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https')
    {
        return TRUE;
    }
    if (empty($_SERVER['HTTPS']) OR strtolower($_SERVER['HTTPS']) == 'off')
    {
     // return FALSE;
        return TRUE;
    }

    return TRUE;
}

Again I can not express how important it is that you do not do this on a production site and that if you do it on your local machine that you revert back to the original before you upload it to a public server.