Braintree-web: Nonce vs. Token for custom vault UI

[simeyla]

General information

• SDK version: 3.39
• Environment: Sandboy
• Browser and OS : .NET API vs JS API v3

Issue description

The Vault manager is great, but it doesn't provide access to Expiration date. So as suggested in this issue I am attempting to load the payment methods from a customer's vault on my server. Then I can show a custom UI including expiration date.

However I'm really puzzled by the following:

• The fetchPaymentMethodsPayload object as returned from the Client Side VaultManager contains ONLY a NONCE to identify which payment method it is.
• The CreditCard object in the server side SDK contains ONLY a TOKEN.

I see no way to generate a NONCE for a credit card on the server side, which is fine because I can use the TOKEN as a unique identifier - but I'm really confused why there's no overlap.

To create a transaction, you must include an Amount and either a PaymentMethodNonce, a PaymentMethodToken, or a CustomerId. Passing a CustomerId is equivalent to passing the PaymentMethodToken of the customer's default payment method.

This shows me that when the time comes to create a sale I can use a nonce, token or customer ID to create the sale.

I guess my questions would be :

• Why are things this way? (Really I'm very curious!)
• Is there a security concern with using TOKEN and passing it to the end user's browser.
• If I wanted to pass a NONCE from the server > client for each payment method could I even do that?
• I have a custom subscription mechanism - can I permanently store a 'token' with a subscription.
• Maybe I don't even need a client authorization token (and can use that static thing) if I load everything server side and use TOKEN. Hmm.

I'm guessing perhaps this is just 'one of those historical things' that has no real reason - but if there is a real reason I don't want to proceed with using a TOKEN if there could be any security concerns.

Thanks

[crookedneighbor]

Why are things this way? (Really I'm very curious!)

The basic difference is that a payment method nonce is a single use token, while a payment method token is a reference to a vaulted payment method which can be used over and over again.

Once a nonce is used in a transaction, or to create a new payment method, it can't be used a second time.

Is there a security concern with using TOKEN and passing it to the end user's browser.

This is really up to your implementation. The key would be to prevent opening your app up to a situation where a fraudulent user could take the token of a legit user and charge against it. Basically, if you're going to use a token directly, always check that the user that is logged in owns the payment method token that will be used to charge on the server.

If I wanted to pass a NONCE from the server > client for each payment method could I even do that?

Yes. See https://developers.braintreepayments.com/reference/request/payment-method-nonce/create/

This is normally be used in conjunction with 3D Secure, but there's no reason you can't use it for your use case.

I have a custom subscription mechanism - can I permanently store a 'token' with a subscription.

When creating a subscription, you must pass a specific payment method token (https://developers.braintreepayments.com/reference/request/subscription/create/#payment_method_token). You can alternatively pass a payment method nonce, but it must refer to a vaulted payment method.

Maybe I don't even need a client authorization token (and can use that static thing) if I load everything server side and use TOKEN. Hmm.

Correct. If you're doing all your vaulting on the server, instead of the client, and you don't need to do 3D Secure, you can (and should) use a tokenization key to tokenize new payment methods.

[crookedneighbor]

I think I've answered all your questions. Please reach out to support if you need additional help: https://help.braintreepayments.com/