title: How to implement 3d secure payment securely
body: <p>I'm wondering what's the best way of accepting payments from credit cards that require <a href="http://en.wikipedia.org/wiki/3-D_Secure" rel="noreferrer">3-D Secure</a> verification. Currently the checkout flow is like this:</p>
  
  <ol>
  <li>Customer submits payment</li>
  <li>Payment gateway returns an error stating that the card requires 3-D secure code processing. Returns the ACS URL in the response</li>
  <li>I redirect user to the issuing bank's verification site and I pass a callback URL for the ACS to redirect after completion of verification</li>
  <li>Customer enters verification code and ACS redirects to the callback URL with an authorization token indicating successful verification</li>
  <li>To complete the process, I have to resubmit the original request with the authorization token to the payment gateway</li>
  </ol>
  
  <p>My problem is in the final step. As I need to resubmit the original request (which contains the credit card information of the customer), I need to store it somewhere temporarily so I can retrieve it when the callback URL is called. Is there an alternative to this? </p>
  
  <p>I'm thinking of trying an iframe solution: The original form is never closed and I display the   verification process in an iframe. When the process completes, i.e. the callback url is called, I hide the iframe and update the original form with the needed values and resubmit. Has anyone tried this technique before?</p>
  
  <hr>