Stripe - Requirement for Strong Customer Authentication

I received the following from Stripe warning of the need to change to a new version of their API. Can you confirm that a new version of the Stripe plug-in is being developed?

Thanks

On September 14, 2019, a new regulation for authentication will be introduced in Europe. Known as Strong Customer Authentication (SCA), this regulation will apply to online payments within the European Economic Area (EEA) where the cardholder’s bank and the business’s payment provider are both in the EEA. Some businesses outside of Europe may also be impacted depending on how European issuers implement the new authentication rules.

SCA requires that businesses use two independent authentication elements to verify payments. Transactions that don’t meet these new authentication requirements or qualify for any exemption may be declined starting September 14, 2019. 3D Secure 2—the new version of 3D Secure rolling out in 2019—will be the primary authentication method used to meet SCA requirements for card payments.

Stripe is building solutions to make it easy for you to comply with the new regulation and minimize the impact on conversion. We have released a beta of a new SCA-ready API—PaymentIntents, that lets you dynamically apply 3D Secure whenever it is required or there is high fraud risk. PaymentIntents will provide support for 3D Secure 2 automatically in early 2019. As soon as SCA requirements go into effect, PaymentIntents will dynamically trigger 3D Secure 2 when required and apply exemptions to SCA requirements when possible.

Currently in beta, you can find more about this API here. Over the coming months, we’ll be expanding the API’s functionality and releasing additional updates to other Stripe products to help you prepare for SCA.

Hello,

The "Stripe Connect (v3)" plugin in the HikaShop marketplace would be compatible with the new system ; it's currently under development with some other new features.

Regards,

hi, what features are you talking about?

please make it ready for the payments setting "sofort" from stripe.
i attached a screenshot from stripe, where the service "sofort" is possible to enable.

Hello,

Yes, integration of other card methods is what is under development ; since the new 3DSecure system will require the same modifications.
But with the fact that the plugin is compatible with HikaMarket and the vendors, that development is more complicated because we are also dealing with the "connect" feature and elements like the fact that we can't know the vendor sub-orders before the creation of the order... Well, it's not simple but we are going forward !

Regards,

I also have this message from Stripe.

So, does your answer mean that the free V2 plugin will not be compatible with the new SCA?

Many thanks

I'm glad I'm not the only one who felt the response from Hikashop wasn't clear!

Let's put it another way....

Q. Will Hikashop release a new version of the FREE Stripe payment gateway which will be SCA compliant?
Q. If yes, approximately when?
Q. If not free, what will be the cost?

Hi,

If the SCA requires 3D secure for all transactions (which seems to be the case reading what is written in the first message) then the plugin available freely for Stripe won't work anymore. We do not plan on doing a new version of that plugin to support it. That would basically require rewritting completely the current plugin, and Obsidev is already working on that.
Obsidev is planning on adding that capability in the next few months to the Stripe V3 plugin available on our marketplace. The cost will be the same as the cost of the plugin right now: www.hikashop.com/marketplace/product/133...nect-by-obsidev.html 40€

Thanks, Nicolas. That makes it clearer. It looks like the new regulation doesn't come in until September so I'll wait for the new V3 plug in to become available.

Thanks Nicolas, that's now clear.

Hi,

Yes. There should be no problem to finish the new version of the plugin before that as the work is already quite advanced from what I heard.

Just a quick query. Is the payment a one off for this plugin or an annual subscription? Will it include all future updates?

Thanks

Dave

Hi,

You'll be able to download the latest version of the plugin for 5 years via the download link given to you after the purchase. After that the download link won't work anymore and you would have to purchase it again should you want / need to update it.
However, I don't think there will be a need to update payment plugins unless Stripe disables and changes the version of its API the plugin is based on. So you should be fine for a long time.

Hi - I have purchased the v3 plugin, but it does not appear to support 3D Secure transactions. It redirects to the listing page with an error 'Your card was declined. This transaction requires two-factor authentication.'. There does not appear to be any attempt to handle the 3D secure portion of the transaction. Until this is resolve (in terms of Stripe Payments) it is no better than the free v2 plugin. There is no real documentation supplied with the v3 plugin, nor does there appear to be any way to directly contact the developer (Obsidev). I'm a web developer myself and have purchased the plugin to save time, but as it's not functioning with the required 3D Secure features in place, I've wasted time rather than saved it. Happy to recieve message directly (off this board) or via this board in regards to this from ether Nicolas or Obsidev. If the update to support 3D Secure is close but not finished, is there any way I can get most recent build with know issues so I can resolve this myself as I have a limited timeframe to get this resolved for a client? Thanks Josh

Josh,

Thanks for trying this and reporting back.

Not a good start at all.

In my opinion, I selected to use Hikashop because of it's support for Stripe. To see Hikashop drop support for Stripe, and then recommend the purchase of a 3rd party Stripe plug-in which is either not ready for 3D secure or is failing, sucks. Quite a lot.

Hello,

The Stripe V2 plugin is still available via Github.

Regarding the support of 3D Secure, I could write a huge message to talk about it, but to summarize, I'm afraid that there is no "stable" way to do it in Stripe right now, it's "deprecated" (and will not work one day, without more precision) or in "beta" (so with something which can change soon with the big modifications coming for July)

Regards,

I can understand this re: Stripe V2 plugin, but I have purchased the Stripe V3 plugin on the basis that I thought it could do 3D Secure.
The v3 Plugin is meant to use Elements, so you can initiate 3D Secure using Payment Intents API calls.
There is a migration guide here:
stripe.com/docs/payments/payment-intents...onfirmation#elements
Is this something you are working on / have worked on ?
If so, can I see the work in progress so I might push it forward to a workable solution?

Hello,

Be sure that we are following that documentation for months now.
The Payment Intent is indeed somethin we want to support and was still in "beta" last week.
That system is still a bit "obscured" since there are a lot of elements that we don't know about, so we cannot know if implementation/usage would work correctly or which are the limitation (like what is the expiration time of a payment intent regarding its capture)

The other thing and that's really bother me, is that I worked for a very long time in order to perform the support of "Sources" and provide an interface which allow to enter the credit card details during the checkout payment selection.
With the Payment Intent, I don't know if it could still work ; and the migration part regarding the support of sources (AliPay, iDeal, Sofort, etc) is not clear yet.
And it is just a very very small part of all questions and interrogation that we have regarding Stripe and the way that the API is evolving. Unfortunately, we are not the only one.

CF : stackoverflow.com/questions/54646239/str...-for-future-payments

[...] PaymentIntents currently does not support creating sources without also creating a charge thereafter. It's also not possible to integrate 3DSecure with the current method of saving credit cards unfortunately.

PaymentIntents is a fairly new Stripe product and we're still working out the kinks and deciding what functionality we'll support down the line. Saving sources is definitely high on our priority list and there'll be more information on this update in the future.

I'm glad to see that PaymentIntents is not marked as "beta" in the Stripe website ; unfortunately, the API is still changing too fast to be able to trust that one choice will continue to work in time.
When I created the first version of Stripe V3, "Sources" were the "stable" way to perform 3D Secure and it was the development that we were doing. In less than a year, every changed and I don't want to propose a plugin which won't work anymore in few months.

Regards,

I've rewritten your v3 plugin to work using Payment Intentions. I've not built in reference storage for future transactions (and there well might be changes to this portion of Stripes API around July this year), but our account process does not require it in any case. However, not providing 3D secure support on a payment integration is a complete non-starter. For my clients in the UK + EU most card transactions involve 3D secure and trying to accept payment without it would be a complete waste of time (and loss of business). I remain somewhat disappointment that I've had to pay 40Euro for something which doesn't work (in real terms) - although I do understand your frustration (especially having just read through it) with Stripe, their documentation and the rapid changes they perform on their API suite.

Hello,

In "end" mode, sure the implementation of PayIntent is not very complicated.
But with a version of a plugin that you do not see, where 75% of the plugin is different in order to ask the credit card during the checkout process and not in the end page... Things are very different !
Now, should I destroy weeks of work just to provide 3D Secure and not being able to release that feature and support of Stripe sources... That's a different question.
When the "sources" development started, it was supporting the 3D Secure, so it should be working if Stripe didn't remove that support in the meantime...
And regarding the price, the plugin contains an integration with Stripe Connect and the development regarding the sources was planned (such as others) ; a price is define by multiple rules and knowing that the plugin will have updates (Original plan is when the API will be mark as stable and no more beta...)

Regards

Hi - yes - I've written custom payment integrations for Hikashop and other carts which do this also, so understand the points in regards to time + effort. As I say, I appreciate the work involved - also that Stripe have a habbit of moving the goal posts - however the integration many people using Hikashop need is fairly simple, and the post order creation method using the Stripe JS with Payment Intent will cover many peoples requirements. For me I purchased the v3 plugin to shortcut development by purchasing a plugin I thought handled 3D secure, but found it didn't. As we're all customers at some point, I'm sure you can understand why that is disappointing - especially as you say it's 'not very complicated' (in fact it could easily run in parallel within current plugin, but with config setting on/off to switch between whether it was enabled or not. Just a suggestion/thought - it may give you more time/less pressure to resolve the more complete implementation you are working on with card payment taken directly pre-order completion. Also, while relatively straight forward, it still takes some time to develop and test and time ultimately is money in this situation at any rate.
Josh