1027908 - Security Review: Serverless in-app payments

Status: RESOLVED FIXED

(mozilla.org :: Security Assurance: Review Request, task)

Description

[Andy McKay]

Project/Feature Name: Serverless in-app payments
Tracking ID: 944480
Description:

This project is to remove the need for a developer to run a server to process in-app payments. It's not really "serverless" because it requires processing by the marketplace servers. But it does remove it from the developers.

Additional Information: https://wiki.mozilla.org/Marketplace/InAppPayments
Key Initiative: Marketplace / Apps
Release date: July 2014
Project status: development
Mozilla Data: Yes
Mozilla Related: Payments for Marketplace
Separate Party: No

Security Review Questions:

Affects products: yes
Review due date:
Review invitees: [e-mail], [e-mail]
Extra information:

Comment 1

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

I think adamm is taking over marketplace stuff from rforbes

Comment 2

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

since the wiki for this is public I am unhiding this bug as I don't see a reason to hide it

Comment 3

[Adam Muntner [:adamm] (use NEEDINFO)]

I am working on the review for this, question:

Is the documentation at https://wiki.mozilla.org/Marketplace/InAppPayments still accurate? If not, could someone please update?

Comment 4

[Andy McKay]

That Wiki looks accurate. We are hoping to roll this out for QA and then into production in the next couple of weeks.

Comment 5

[Adam Muntner [:adamm] (use NEEDINFO)]

Andy,
Just so I'm clear, can you specifically point me to the code and instance/urls that are in scope for this review? I don't want to leave anything out.

Comment 6

[Andy McKay]

The changes are in zamboni and webpay, but cover quite a lot of end points, pull requests and the like. Jared and Kumar worked on this, so better to ping them. Here's some API docs:

http://firefox-marketplace-api.readthedocs.org/en/latest/topics/payment.html#in-app-products
http://firefox-marketplace-api.readthedocs.org/en/latest/topics/payment.html#preparing-payment
http://firefox-marketplace-api.readthedocs.org/en/latest/topics/payment.html#payment-status

Would a quick diagram, chat, etherpad make sense here to review the flow?

Comment 7

[Adam Muntner [:adamm] (use NEEDINFO)]

Closing, not doing reviews through this process any longer