GetAuthenticationPacket Method

Returns the Payer Authentication Request packet that is to be sent to the ACS.

Syntax

mpi.getAuthenticationPacket([callback])

Callback

The 'callback' parameter specifies a function which will be called when the operation completes (or an error is encountered). If the 'callback' parameter is not specified, then the method will block and will not return until the operation completes (or an error is encountered).

The callback for this method is defined as:

function(err, data){ }

'err' is the error that occurred. If there was no error, then 'err' is 'null'.

'data' is the value returned by the method.

'err' has 2 properties which hold detailed information:

err.code
err.message

Remarks

This method builds the Payer Authentication Request (PAReq) message from the data contained in the class's properties. The message is then compressed, encoded, and returned by this method. This packet should then be sent to the URL of the Access Control Server (ACS), stored in the ACSURL property.

The PAReq request must be sent through the cardholder's browser, and thus cannot be sent by the class itself. The following Javascript code demonstrates one way to send this packet through the user's browser:

The TermUrl is the location of a page that will handle the rest of the ordering process. The Visa Access Control Server will post back to the URL entered in this field with the results of the Payer Authentication Request. The MD field should contain any additional information needed by the merchant to complete the transaction. This may include information such as a TransactionId, MessageId, or any other data needed to match the response with a pending authentication. This may be raw text, XML, or any other data type. It is not recommended that sensitive data such as a CardNumber be contained in this field. If this is unavoidable, such sensitive data must be encrypted.

The response to the PAReq, the PARes, will be posted to the TermUrl that you send to the ACS as shown in the example above. At that time you can use CheckAuthenticationResponse to verify the response signature and parse the response.