<p>Which eWay are you implementing?</p>

<p>We have used eWAY Rapid Direct with no issues for over a year now with Commerce.</p>

<p>They key most people seem to miss is that you must implement the CSE - Client Side Encryption part of the eWay process before the gateway submission to eWay will wok.  This is documented by eWay here:</p>

<p><a href="https://eway.io/api-v3/#how-it-works" rel="nofollow noreferrer">https://eway.io/api-v3/#how-it-works</a></p>

<p>In essense you just need to include some JS on your payment form page.  On that page you accept the card number etc pretty much as normal, but <em>before you pass it to eway</em> is must be encrypted on the client machine.  Here's some scrappy JS to show what I mean first include the eWay JS:</p>

<pre><code>                    {# Include EWAY CSE JS #}
                {% if craft.config.devMode %}
                    &lt;script src="https://secure.ewaypayments.com/scripts/eCrypt.debug.js"&gt;&lt;/script&gt;
                {% else %}
                    &lt;script src="https://secure.ewaypayments.com/scripts/eCrypt.js"&gt;&lt;/script&gt;
                {% endif %}
</code></pre>

<p>...and in your payment form have something like this as you will need it later (I store my key in the commerce config file so I can set a dev vs live one based on environment, but you could jstu hardcode it below or whatever):</p>

<pre><code>              {% set paymentMethods = craft.commerce.paymentMethods %}
                  &lt;input type="hidden" name="CSEKey" value="{{ paymentMethods[1].settings.CSEKey }}"&gt;
</code></pre>

<p>Then, you need to deal with the actual encryption side of things...something like this should do it for you:</p>

<pre><code>        var method = $('input[name=paymentMethodId]:checked', '#submitOrder').val();

    if (method == 1) {
        // EWAY Client Side Encryption - See https://eway.io/api-v3/#encrypt-function

        // EWAY CSE - encrypt the card number and the CCV on the client's machine so it's never seen by us or anyone else.
        // Pull the values from the test input fields (fake*)
        // and inject the encrypted version into the real fields
        var $fakeCardNumber = $("#fakeNumber");
        var $fakeCcv = $("#fakeCvv");
        var $cardNumber = $("input[name=encryptedCardNumber]");
        var $ccv = $("input[name=encryptedCardCvv]");

        // get the unencrypted values and remove all spaces from the numbers
        var cardNumber = $fakeCardNumber.val().replace(/\s/g, "");
        var ccv = $fakeCcv.val().replace(/\s/g, "");

        // and now re-set them to the encrypted values if these are actually filled in
        if (cardNumber) {
            $cardNumber.val(eCrypt.encryptValue(cardNumber, CSEKey));
        }
        if (ccv) {
            $ccv.val(eCrypt.encryptValue(ccv, CSEKey));
        }
    }
</code></pre>

<p>That's not the most beautiful code, but I think once you've implemented that (which you need tom to be compliant with eWay) - you will find things drop into place easily enough from there.</p>

CC BY-SA 3.0
2017-09-27T23:44:05.517Z
thank you so much, I am using eway Rapid 3. I guess it is the same, I will just add the Csekey from the account, and give it a try with your solution.
MariaZ
CC BY-SA 3.0
2017-09-27T23:48:32.997Z
Yep with any of the eWays you have to do the CSE, OR you have to prove to them your are PCI compliant in full, before you can take live payments...
Jeremy Daalder
CC BY-SA 3.0
2017-09-26T23:49:56.147Z
2017-09-26T23:49:56.147Z
Jeremy Daalder
<p>I am having some problems on integrating Craft Commerce with <a href="https://github.com/thephpleague/omnipay-eway" rel="nofollow noreferrer">eWAY</a>.
When I submit the payment form, I get this error:</p>

<blockquote>
  <p>Error: [Payment error: EWAY_CARDNAME Required, EWAY_CARDNUMBER Required, Invalid EWAY_CARDEXPIRYMONTH, Invalid EWAY_CARDEXPIRYYEAR, EWAY_CARDCVN Required]</p>
</blockquote>

<p>Should the eWAY gateway plugin be converting the form input field names to these eWAY field names?</p>

<plugin-craftcommerce><payment>
Craft Commerce eWAY payment error
# Craft Commerce eWAY payment error

(Asked by: username_0 on 2017-09-26)

I am having some problems on integrating Craft Commerce with [eWAY](https://github.com/thephpleague/omnipay-eway).
When I submit the payment form, I get this error:

> Error: [Payment error: EWAY\_CARDNAME Required, EWAY\_CARDNUMBER Required, Invalid EWAY\_CARDEXPIRYMONTH, Invalid EWAY\_CARDEXPIRYYEAR, EWAY\_CARDCVN Required]

Should the eWAY gateway plugin be converting the form input field names to these eWAY field names?

**Tags:** plugin-craftcommerce, payment

---

## 1 answers

### Answer by username_1 on 2017-09-26. Score: 2

Which eWay are you implementing?
We have used eWAY Rapid Direct with no issues for over a year now with Commerce.
They key most people seem to miss is that you must implement the CSE - Client Side Encryption part of the eWay process before the gateway submission to eWay will wok.  This is documented by eWay here:
https://eway.io/api-v3/#how-it-works
In essense you just need to include some JS on your payment form page.  On that page you accept the card number etc pretty much as normal, but before you pass it to eway is must be encrypted on the client machine.  Here's some scrappy JS to show what I mean first include the eWay JS:
                    {# Include EWAY CSE JS #}
                {% if craft.config.devMode %}
                    
                {% else %}
                    
                {% endif %}

...and in your payment form have something like this as you will need it later (I store my key in the commerce config file so I can set a dev vs live one based on environment, but you could jstu hardcode it below or whatever):
              {% set paymentMethods = craft.commerce.paymentMethods %}
                  

Then, you need to deal with the actual encryption side of things...something like this should do it for you:
        var method = $('input[name=paymentMethodId]:checked', '#submitOrder').val();

    if (method == 1) {
        // EWAY Client Side Encryption - See https://eway.io/api-v3/#encrypt-function

        // EWAY CSE - encrypt the card number and the CCV on the client's machine so it's never seen by us or anyone else.
        // Pull the values from the test input fields (fake*)
        // and inject the encrypted version into the real fields
        var $fakeCardNumber = $("#fakeNumber");
        var $fakeCcv = $("#fakeCvv");
        var $cardNumber = $("input[name=encryptedCardNumber]");
        var $ccv = $("input[name=encryptedCardCvv]");

        // get the unencrypted values and remove all spaces from the numbers
        var cardNumber = $fakeCardNumber.val().replace(/\s/g, "");
        var ccv = $fakeCcv.val().replace(/\s/g, "");

        // and now re-set them to the encrypted values if these are actually filled in
        if (cardNumber) {
            $cardNumber.val(eCrypt.encryptValue(cardNumber, CSEKey));
        }
        if (ccv) {
            $ccv.val(eCrypt.encryptValue(ccv, CSEKey));
        }
    }

That's not the most beautiful code, but I think once you've implemented that (which you need tom to be compliant with eWay) - you will find things drop into place easily enough from there.

> **Comments:**
> **username_0**: thank you so much, I am using eway Rapid 3. I guess it is the same, I will just add the Csekey from the account, and give it a try with your solution.  
> **username_1**: Yep with any of the eWays you have to do the CSE, OR you have to prove to them your are PCI compliant in full, before you can take live payments...  

---

