Allowing automatic login with sub_token link?


It's a huge friction point to make a customer login to update their card info for their subscriptions.

How can we include their password with the sub_token link? Or somehow have the customer automatically logged in once they hit the "update payment info" link in an email?

  • brettbrett FoxyCart Team
    edited November 2016
    Hi @Epotratz. I hear you on the friction, but the rationale for requiring it is to keep things secure. Though it's easy enough to assume a customer won't ever copy/paste their URL and Tweet it out (or more likely, forward the email to somebody), it could happen, which (if the customer were logged in without a password) would then result in the customer's name, address, cart contents, last 4 of the CC#, and potentially other info being exposed. Potentially more problematic would be an attacker then modifying the cart and shipping address, and using the victim's saved payment info to purchase something for the attacker. (Granted, it's arguably a small risk, but it's enough that we won't likely offer native functionality to do this.)

    That said, perhaps it would be worthwhile extra functionality for us to explore, to allow a way to update a payment method without actually exposing any personal information or allowing cart modification. We'll keep that in mind as we work towards improvements on our end.

    I'll whisper a little extra info in case it helps.
  • @brett,

    Regarding security, the 3-digit CSC code would still need to be known by the potential "hacker" to make any charges or changes right?
  • brettbrett FoxyCart Team
    @Epotratz, yes, that's true. I'm embarrassed I neglected that, particularly because we actually recently discussed that internally for a somewhat similar situation another user asked us about. Totally slipped my mind here though :)
Sign In or Register to comment.