<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On May 13, 2015, at 5:28 PM, Nicholas Alexander <<a href="mailto:nalexander@mozilla.com" class="">nalexander@mozilla.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><br class="Apple-interchange-newline"><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><div class="gmail_quote" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">On Wed, May 13, 2015 at 3:02 PM, Kumar McMillan<span class="Apple-converted-space"> </span><span dir="ltr" class=""><<a href="mailto:kmcmillan@mozilla.com" target="_blank" class="">kmcmillan@mozilla.com</a>></span><span class="Apple-converted-space"> </span>wrote:<br class=""><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-color: rgb(204, 204, 204); border-left-style: solid; padding-left: 1ex;"><div style="word-wrap: break-word;" class="">Hi all.<div class=""><br class=""></div><div class="">This is for Ryan Kelly (or anyone) to check what we’d like to do for payments to see if it’s sane. We started talking about it before but this email adds a few more details.</div><div class=""><br class=""></div><div class="">The goal: provide generic payment processing via Firefox Accounts so that any Mozilla site can sell premium services. The user should only have to log in *once* to purchase the product.</div><div class=""><br class=""></div><div class="">Abstract user flow:</div><div class=""><br class=""></div><div class="">- User decides to purchase 20GB more of Mozilla Backup storage for $9.99 / month (just an example)</div><div class="">- Click the purchase button</div><div class="">- Sign in with Firefox Account</div><div class="">- Enter credit card information</div><div class="">- Enjoy enhanced storage</div><div class=""><br class=""></div><div class="">Implementation proposal:</div><div class=""><br class=""></div><div class="">- On <a href="http://mozillabackup.com/" target="_blank" class="">backup.firefox.com</a> , the click of a purchase button begins an OAuth flow by requesting a code->token with the scope ‘profile payments’</div><div class="">-<span class="Apple-converted-space"> </span><a href="http://mozillabackup.com/" target="_blank" class="">backup.firefox.com</a> opens an iframe (or redirect) to<span class="Apple-converted-space"> </span><a href="http://payments.mozilla.com/" target="_blank" class="">payments.mozilla.com</a> and passes the OAuth token as a GET parameter</div><div class="">-<span class="Apple-converted-space"> </span><a href="http://payments.mozilla.com/" target="_blank" class="">payments.mozilla.com</a> verifies the token on the server and checks that it has the *payments* scope</div><div class="">- payment processing proceeds…</div></div></blockquote><div class=""><br class=""></div><div class="">I'm not an expert, but this seems odd. Suppose backup wanted to support multiple payment providers, or<span class="Apple-converted-space"> </span><a href="http://payments.mozilla.com/" class="">payments.mozilla.com</a><span class="Apple-converted-space"> </span>were run by a third-party. </div></div></div></blockquote><div><br class=""></div>We’re assuming the Mozilla site would only use one payment processor (the Mozilla one).</div><div><br class=""><blockquote type="cite" class=""><div class=""><div class="gmail_quote" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div class="">It wouldn't be sensible for backup to initiate the login flow; it would be sensible for backup to ask payments (or the appropriate payment provider) to initiate a payment flow, which for<span class="Apple-converted-space"> </span><a href="http://payments.mozilla.com/" class="">payments.mozilla.com</a><span class="Apple-converted-space"> </span>would know about FxA. (For some other provider, it would likely not.)<br class=""></div></div></div></blockquote><div><br class=""></div>We’re thinking that by nature you could already be logged into <a href="http://backup.firefox.com" class="">backup.firefox.com</a> for whatever reason; e.g. you would need to log in to access your data or just simply to use the site. If we change it so the payments site requests the login then I see many potential double login situations. We’re trying to avoid that at all costs. If we end up with a tight coupling between the Mozilla site and the payment processor then that’s ok.</div><div><br class=""><blockquote type="cite" class=""><div class=""><div class="gmail_quote" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div class=""><br class=""></div><div class="">That is, it seems that the redirect flow should be split: backup and payments communicate with one redirect type of flow; and then payments and FxA communicate with a separate redirect flow.<br class=""><br class=""></div><div class="">Please critique.</div></div></div></blockquote><blockquote type="cite" class=""><div class=""><div class="gmail_quote" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div class=""><br class=""></div><div class="">Nick<br class=""></div><div class=""> </div><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-color: rgb(204, 204, 204); border-left-style: solid; padding-left: 1ex;"><div style="word-wrap: break-word;" class=""><div class=""><br class=""></div><div class="">Does that sound sane? This makes token sharing sound scary: <a href="https://developer.mozilla.org/en-US/docs/Mozilla/Tech/Firefox_Accounts/Introduction#Security_considerations" target="_blank" class="">https://developer.mozilla.org/en-US/docs/Mozilla/Tech/Firefox_Accounts/Introduction#Security_considerations</a></div><span class="HOEnZb"><font color="#888888" class=""><div class=""><br class=""></div><div class=""><br class=""></div><div class="">-Kumar</div></font></span></div><br class="">_______________________________________________<br class="">Dev-fxacct mailing list<br class=""><a href="mailto:Dev-fxacct@mozilla.org" class="">Dev-fxacct@mozilla.org</a><br class=""><a href="https://mail.mozilla.org/listinfo/dev-fxacct" target="_blank" class="">https://mail.mozilla.org/listinfo/dev-fxacct</a></blockquote></div></div></blockquote></div><br class=""></body></html>