Flo2Cash Payments (duplicate charge problem)

[georgim]

Dear all,
I am currently (and since not much long ago) working on a project that uses Zen Cart with integrated Flo2Cash direct credit card payments. We are experiencing a very unpleasant problem that causes us to charge our users twice if they hit the refresh button in the middle of the payment process (checkout_process.php makes a CURL call to Flo2Cash transperently for the user in the backend). This CURL call lasts a bit more than 5 seconds where I am testing and some eager users are likely to hit the refresh.

The first approach I have tried is to implement the PRG (Post-Redirect-Get a.k.a. Redirect After Post) design pattern for this solution in order to diminish the double-form-submission (and this very ugly browser dialogue that asks you if you wanted to resend the form data to the server), but it didn't really help us so far. The problem is with the CURL call.

The Flo2Cash module currently relies on the output from the CURL request and if it has been successful, it stores the order object (array) in the database. We also thought of checking for a previous order within a short timeframe from the same customers_id and with the same order_total, but we can't really tell this way if the user really wanted to buy another piece of the same item. We also don't know if his connection was not really bad and if that caused him to refresh.

Another idea that we worked on is to introduce another object - payments, and store a payment ID with different statuses = initated, processing, paid, failed. The problem with that is again the CURL request. If you hit F5 after having been charged (after Flo2Cash have received our request), but before saving the data in our database, we don't really know if the payment has been successful or not. Thus, we cannot update the status.

So currently I am thinking of 2 other solutions:
1) multithreading deamon that starts another php process on the server, responsible for a single payment and storing the status in the database on its own. In the same time I can keep the process ID with the payment ID in the session and just ask if the database has been updated, and if not - if the process is still running. This way I can also refresh the page so that the enduser knows we are still processing his payment and doesn't spam the refresh button in that period of time. This seems to be ok, but our client is getting nervous already and it seems like a too much a do for this "simple job".
2) a cronjob that runs every minute and checks for the payments database. If it finds a payment that has been processed (CURL call started) a minute ago, but has no reply it pays on its own (the cronjob script I mean) or informs the customer service that there has been some problem with the payment. In the same time, the checkout_process.php doesn't let you make any other CURL call for the same payment_ID and let's you know there has been a problem with your payment and you will be contacted in a while from our customer service. Unfortunately, this also seems to be too much for our client.

Could you please consider the problem and let me know if you have any other ideas that could be done more quickly or if you think I should do what I know is to be done. Has anyone else from you used this payment processor (Flo2Cash) and do you have the same problem. What kind of Zen Cart version are you running and what is the version of the Flo2Cash module.

Thank you very much for your time, I appreciate your assistance. Trolls will be fed after I am done with the task, so please come back after I say "I have fixed it" if you wish to troll.

Thank you once again.

Best Regards,
Georgi

[DrByte]

Have you considered displaying a small modal dialog which says "please wait while we process your request"?
Have you talked to the gateway's tech department to determine why their processing is taking so long?
Have you tested on servers which have a faster speed internet backbone connection?