A bug in card payments?

Questions
1

I think I found a bug in in the production version of square.js

Here’s how I produced it.
On my payment screen, I made javascript execute the card object (not google or apple pay).

Then I purposely entered an invalid credit card number as follows:

Card number: 4800 0000 0000 0004
Expiry: 11/33
CVC: 911
Zip code: 11111

When I clicked the pay button (button the fetches the token and attempts to complete payment), a normal failure result occurs (claiming the bank refused the transaction). But after clicking it about 6 times in a one minute period with the same info above, I get the following error in my javascript console (you’d see this in firefox developer tools):

error  
TokenizationError: Tokenization has failed
  An unknown error has occurred
Stack trace:
Xn@https://web.squarecdn.com/v1/square.js:3:140911
Mi@https://web.squarecdn.com/v1/square.js:3:151190
Bd@https://web.squarecdn.com/v1/square.js:3:289413
deserialize@https://web.squarecdn.com/v1/square.js:3:289699
listener@https://web.squarecdn.com/v1/square.js:3:213010
handleMessage/</<@https://web.squarecdn.com/v1/square.js:3:211744
handleMessage/<@https://web.squarecdn.com/v1/square.js:3:211731
handleMessage@https://web.squarecdn.com/v1/square.js:3:211716
handleMessage/<@https://web.squarecdn.com/v1/square.js:3:209728
handleMessage@https://web.squarecdn.com/v1/square.js:3:209715
hc/this.receiveMessage@https://web.squarecdn.com/v1/square.js:3:208256
square.js:3:93717
error ,Error: Tokenization has failed
  An unknown error has occurred
square.js:3

I was hoping to receive some error code about excessive attempts, but this unknown error confuses me.

Is there something else I can do to rectify this?

I don’t want it where one crazy customer clicks the pay button 50 times a second and causes the system to NOT work for the next customer that sincerely wants to make a purchase.

3

As for the cache idea…
it might not make a difference because square.js comes from two different domains depending on whether I’m using the live or sandbox version of square, and it will probably load the same contents again unless square deliberately changes the contents of square.js in which case I should figure out how to get onto a mailing list so when the file changes, square will let me know and I’ll tell my existing customers to clear their cache.

Rate limiting is an idea, but my checkout form is in 3 parts:
Part 1: Customer fills in information (info stored on square)
Part 2: Customer chooses payment method
Part 3: Customer fills in card details (info retrieved from square then stored on square after card info is complete)

What I did notice is that when I got the error and I waited about 5-10 minutes to try again, the operation worked (no unknown error) so I suspect such error is related to rate-limiting but because I do the payment processing all in a try block like:

try{insert square code here...}catch(e){errors...}

the unknown error is generated because the code inside catch(e) is executed instead, suggesting that one of squares functions cannot be completed.

That’s why I’m claiming it as a bug, because the error is “unknown”.

4

I tried to replicate this on both FireFox and Chrome and wasn’t able to replicate the error. Are you still able to reliably replicate this? :slightly_smiling_face:

5

Yes.

I also tried the test in Firefox Version 127.0.2 32-bit for linux.
I used the same invalid credit card information 5 times in a row sending a request to square once
every 10 seconds. Then everytime after the 5th, I get the same unknown error

6

I’ve reached out to the team about this but we haven’t been able to replicate this. Also to be honest this would only effect the customer that’s excessively clicking. Any other customer on another session of the Web Payments SDK won’t be effected by this. :slightly_smiling_face:

7

Can you instead of returning an unknown error for the tokenization, return an excessive error with a
value of how long the same person has to wait before retrying? because right now, I have it in my
code that such unknown failures mean to tell people to try a different web browser.