driving me nuts...not that's a long trip

[nine72]

ok, so here's the deal.
I have created a quite robust order/payment procesing setup that sends to our processing gateway. I have now been asked to devise a way to authenticate a "login" from a merchants website that REFUSES to use SSL on his side.

I need ideas/guidance/eamples of how to acomplish this.

The path that this will take is as follows.

Merchant Checkout Page --> POST
(will need to send somekind of id info - encripted with sha1 min.)
POST received at a "Catch Page" verify id info --> redirect to URL for that merchnat on our secured server. force https at this point and load the payment procesing page. From the point of the processing page I have it undercontrol.

This is based loosely from the old Verisign Payflow link design. (think paypall has it now.)

Anyway is all in php on this side posting page from merchnat is good ol html.

Again ANY direction would be helpful

Regards, nine72

[bevort]

Think step by step
First what do I send (look at it by sending it to your self, maybe another server)
next how does it end up by that merchant (try to simulate)
What do I get back (a html file or something else)
how does it arive on our server.
What kind of vars are send ($_POST or should i use $_GET)

Try to recreate his or her interface toward you.
Look also to there forms. This gives you the names of the vars bouncing around

Do al of this by hand so that you know what's going on first THEN start coding