3rd Party Gateways & iFrames

Has anyone here tried implementing a 3rd party payment gateway through an iFrame with Zen Cart, such as the Quantum Gateway iframe API solution?

I am interested in providing a payment solution that avoids the need for pa dss requirements, but also keeps the visitor on-site, or at least in their eyes.

I would not have considered iFrames previously, but am recently noticing that some 3rd party gateways are now providing specific solutions designed for use in iframes, which is making me rethink the possibility.

Any thoughts appreciated.

iFrames in general break ZenCarts session control

Thanks for the reply

When you mention iframes breaking session control, would that still be the case if the iframe is simply placed in a small corner of the checkout page only?

This seems to be a bit of a trend for certain payment processors (supplying an iframe solution), especially as come June of this year, I think users of carts such as zen cart (and most if not all open source) may be required to use 3rd party gateways due to the pa dss requirement - so an "integrated" 3rd party gateway solution will become very much desired I would think, since diverting to a 3rd party site for checkout still seems to lower conversion according to what I've read...

Thanks again

... and because of issues relating to website spoofing and fraud, most gateways will not process a transaction that comes out of an Iframe, so the idea of building a site in HTML and then "rendering zencart functions" via an iframe are a waste of time. In addition to the session issues described, payment gateways are likely to reject the transaction.

The time, effort, energy, hassle, anguish, exasperation and consequent disappointment in trying to carve up a eCommerce system (be in zencart or any other) can be aleviated simply by building the site into the eCommerce framework from step one.

schoolboy - Thanks for the reply...

The whole reason for my own interest in this is that some payment providers ARE offering this as a solution. In fact, Quantum even has an API for it...

If these providers are willing to specifically target iframe solutions, doesn't it warrant some review? Or are they simply being foolish? Considering Quantum is PCI certified, I can't help but to think they've put some thought into the process...

I can't answer for individual Payment gateways, so I have no idea how they code their API to cater for this.

Over the years I have had many requests from people (whose clunky old HTML sites are well-established) to enbed zencart into their site. After a few (metaphorical) smacks around the face, they normally "see the light", and decide to enter the 21st century and build new sites in zencart.

Sometimes it is challenging (difficult) to skin zencart exactly the way the original site looked, but I convince my clients that functionality is paramount... webshoppers are not particularly phased if a sit looks quite plain and simple... in fat they prefer it. They aren't there for entertainment, so I never use flash. They aren't there to read the life stories of other users, so I don't embed blogs, whos online, read about my dog, google adwords, etc, ect.

I focus on techniques that encourage SALES... and more SALES and more SALES.

That is why you have a webshop, surely... to make MONEY. :D

Schoolboy -

It sounds like you've been around the product quite awhile, so I appreciate your input.

I really want to see this cart continue it's success, and be a viable solution for years to come. The regulations that are approaching this year are going to change the way this and other open source carts can function, requiring a redirect gateway method in order to retain compliance. I'm concerned about this, as my experience with conversion percentage between integrated and redirected payment methods is heavily in favor of the integrated.

This is why the iframe concept is so intriguing to me - it seems to be gaining some support from well known payment gateways, so it would really be great if such an implementation can exist successfully within a Zen Cart, even if only for the one or two common gateways that support it.

requiring a redirect gateway method in order to retain compliance.

... what makes you think that is the only way?

Kim:

... what makes you think that is the only way?

Well, unfortunately, my bank is doing the thinking for me - but the only two methods I know of to process a credit card payment through a shopping cart in an automated fashion are:

1. the integrated method, in which my site collects the cc data (which I use right now). To use this I must be PCI compliant (which I am) - but according to my bank, in order to continue using this method past june 2010, my software needs to be pa-dss certified as well (even if I don't actually store the cc data)...

2. the gateway method, in which my site collects the shopping cart quantities & pricing, and then upon requesting 'checkout', the user is redirected to a compliant 3rd party payment gateway, which then collects all of the cc details mentioned above. This method, according to my bank, still requires me to be PCI compliant - however, excludes me from the pa-dss certified cart requirement (and, thus, they will continue to process my transactions).

These are the only two methods I know of, short of doing it manually. My discussion of iFrames here is an effort to see if I can switch to option 2 above, but do it in a way that still looks like option 1.

If there is another way to do this, I am very much open to hearing about it! Thanks...

July 2010 is the deadline for Level 4 merchants and Visa processors to be certified PCI compliant. In the meantime, we are working towards being PA-DSS certified.

Kim:

July 2010 is the deadline for Level 4 merchants and Visa processors to be certified PCI compliant. In the meantime, we are working towards being PA-DSS certified.

Thanks for your reply...

Obviously I can only speak for myself - but according to our bank we had to be PCI Compliant over a year ago (in fact, we started seeing 'non-compliance' fees on our merchant statement which obviously caught my attention :shocking:)

And according to the letter they sent me recently, which I am looking at now, the pa-dss deadline is July 2010, and they are requiring me to provide my documentation and course of action by June 15th in order to "avoid a disruption in service"... :ohmy:

Again, I speak only for myself - this is the situation my bank has presented me with. I know a couple other online merchants who are facing slightly different requirements, but at this point I'm really only worrying about numero-uno!!