Question
Last activity: 30 Jul 2015 8:13 EDT
credit card information without storing on pega server
We have a requirement to send credit card information from pega application to a REST service without storing the card information on the Pega server. The REST service will return a token which will then be stored within pega application to refer to that card.
We are thinking of an option to use AJAX which would call a pega activity which in turn calls the REST service. Once the token is received, the credit card information can be removed from the clipboard and only the token is retained.
Is there any other way to implement this requirement? Can we make an AJAX call directly to REST service and populate the returned token into a field using JavaScript without going through the pega server?
Pegasystems Inc.
US
It sounds like your goal is to never have the credit card number be part of the work object so it never gets saved to the database in clear text.
In PRPC you can create a property that has a type of "TextEncyrpted".
Video: https://docs-previous.pega.com/encrypting-properties-and-blobs
Lastest Help: https://community.pega.com/sites/default/files/help_v718/procomhelpmain.htm
This can be used to secure content like credit card numbers for database storage.
You could also do the AJAX approach as well. You can have an activity that you call via AJAX that takes the credit card number, puts it to a ClipboardPage, run your Connect-REST call, return the token value, then clear the page as the last step.
AJAX Call:
<script>
function getCCToken(){
var oSafeURL = new SafeURL("@baseclass.getCCToken");
var callback = {success: handleHTTPSuccess, failure: handleHTTPFailure};
callback.timeout=30000;
var oPostData = new SafeURL();
oPostData.put("ccnumber", [CREDIT_CARD_NUMBER]);
/* Sending a credit card number, use POST */
It sounds like your goal is to never have the credit card number be part of the work object so it never gets saved to the database in clear text.
In PRPC you can create a property that has a type of "TextEncyrpted".
Video: https://docs-previous.pega.com/encrypting-properties-and-blobs
Lastest Help: https://community.pega.com/sites/default/files/help_v718/procomhelpmain.htm
This can be used to secure content like credit card numbers for database storage.
You could also do the AJAX approach as well. You can have an activity that you call via AJAX that takes the credit card number, puts it to a ClipboardPage, run your Connect-REST call, return the token value, then clear the page as the last step.
AJAX Call:
<script>
function getCCToken(){
var oSafeURL = new SafeURL("@baseclass.getCCToken");
var callback = {success: handleHTTPSuccess, failure: handleHTTPFailure};
callback.timeout=30000;
var oPostData = new SafeURL();
oPostData.put("ccnumber", [CREDIT_CARD_NUMBER]);
/* Sending a credit card number, use POST */
pega.util.Connect.asyncRequest('POST',oSafeURL.toURL(), callback, oPostData.toEncodedPostBody());
}
function handleHTTPSuccess(responseObj)
{
var responseText = responseObj.responseText;
/* responseText now contians the response from the rest service or error message from activity*/
}
function handleHTTPFailure(responseObj)
{
/*Do something, you have an HTTP error */
}
</script>
SUDO Activity:
1) Page-New (CCTemp)
2) Property-Set (CCTemp.ccnumber = param.ccnumber)
3) Connect-Rest (CCTemp)
Success:
4) Property-Show (CCTemp.cctoken) [Result of Connect-Rest]
Fail:
5) Property-Show (ERROR)
6) Page-Remove (CCTemp)
The AJAX response will get either token or an error message. Add a stucture if you want. The CC number is never stored within a PRPC object and is short lived on the clipboard.
You could also try making a direct request to the rest service through AJAX. The browser may deny the request if the service is in a seperate domain.