Pass a Secure Request

You can use the Store Builder Library (SBL) to pass sensitive information in an encrypted format. This is necessary to hide information that customers should not have access to. To secure the information, follow the steps below:

1. Set up encryption in FastSpring.
2. Create a session object containing relevant data.
3. Locally encrypt the session object to protect the data.
4. Pass the encrypted payload to FastSpring.

FastSpring will decrypt the payload and apply the information to the associated order session.

Set Up Encryption

🚧

This step is only necessary for initial setup. If you have set up encryption before, you can skip this step.

1. Navigate to Integrations > Store Builder Library.
2. Copy the Access Key. You will use this key and data-access-key to initialize the SBL.
3. Create a Private/Public certificate pair.
   • Private: Create a 2048-bit RSA private key. Do not share this key. You will use the private key PEM file privatekey.pem to create your secureKey.
   • Public: Create a 2048-bit RSA public key. Only share this key with FastSpring. FastSpring will use your public key PEM file publiccert.pem to decrypt your payload.
4. Under File Upload, click Choose File. Select the file containing your public certificate.
5. Click Save.

Create a Session Object

Create a session object containing all of the information which you would like to encrypt. The required fields will vary depending on the information collected.

<script>
var fscSession = {
    'reset': true,
    'products' : [
                    {
                        'path':'example-product',
                        'quantity': 1
                    }
    ],
    'coupon': 'YOUR10OFF'
}
</script>
<script
    id="fsc-api"
    src="https://d1f8f9xcsvx3ha.cloudfront.net/sbl/0.8.7/fastspring-builder.min.js"" type="text/javascript"

Locally Encrypt the Session Object

After you create the session object, locally encrypt the data. This varies depending on the programming language you are using. FastSpring will use your secureKey string and publiccert.pem to decrypt your securePayload string.

Java

1. Create a 16-byte aesKey for each payload.

final KeyGenerator keyGenerator = KeyGenerator.getInstance("AES"); keyGenerator.init(128); final SecretKey secretKey = keyGenerator.generateKey() ; final byte[] aesKey = secretKey.getEncoded() ;

2. Use the random 16-byte AES key to create the securePayload string from your unencryptedString. This is typically a Base64 string, but it can be a raw byte.

final SecretKeySpec secretKeySpec = new SecretKeySpec(aesKey, "AES"); final Cipher encryptCipher = Cipher.getInstance("AES/ECB/PKCS5Padding"); encryptCipher.init(Cipher.ENCRYPT_MODE, secretKeySpec); final byte[] cleartext = unencryptedString.getBytes("UTF-8"); final byte[] ciphertext = encryptCipher.doFinal(cleartext); final String securePayload = Base64.getEncoder().encodeToString(ciphertext);

3. Use the random 16-byte AES key to create the securePayload string from your unencryptedString.

final org.bouncycastle.openssl.PEMReader pemReader = new org.bouncycastle.openssl.PEMReader(new StringReader(privateKeyPEM));|
final KeyPair keyPair = (KeyPair) pemReader.readObject() ;
pemReader.close() ;
final PrivateKey privateKey = keyPair.getPrivate() ;
final Cipher clientPrivateCipher = Cipher.getInstance("RSA/ECB/PKCS1Padding") ;
clientPrivateCipher.init(Cipher.ENCRYPT_MODE, privateKey) ;
final byte[] aesKeyEncrypted = clientPrivateCipher.doFinal(aesKey) ;
final String secureKey = Base64.getEncoder().encodeToString(aesKeyEncrypted) ;

FastSpring uses your secureKey string and publiccert.pem to decrypt your securePayload string.

PHP

1. Create a 16 byte AES key for each payload.

$aesKey = openssl_random_pseudo_bytes(16) ; # or urandom() or any other random byte generator

2. Use the random 16-byte AES key to create the securePayload string from your unencryptedString. This is typically a Base64 string, but it can be a raw byte.

$cipherText = openssl_encrypt($unencryptedString, "AES-128-ECB", $aesKey, OPENSSL_RAW_DATA) ;
$securePayload = base64_encode($cipherText) ;

3. Encrypt your AES key with the privatekey.pem file. This creates your secureKey string.

$privateKeyFileName = realpath("privatekey.pem") ;
$privateKey = openssl_pkey_get_private("file://$privateKeyFileName") ;
openssl_private_encrypt($aesKey, $aesKeyEncrypted, $privateKey) ;
$secureKey = base64_encode($aesKeyEncrypted) ;

FastSpring will use your secureKey string and publiccert.pem to decrypt your securePayload string.

Pass the Encrypted Payload

There are 2 ways to pass the encrypted payload:

• fscSession: Apply the data when the page loads.

<script>
var fscSession = {
	'secure': {
		'payload': securedData, // string of encrypted data passed from the server
		'key': secureKey // secure key passed from the server
	}
}
</script>
<!-- placing the session object before the Library is initialized ensures that the data will be sent with the very first request -->
<script
	id="fsc-api"
	src="https://d1f8f9xcsvx3ha.cloudfront.net/sbl/0.8.7/fastspring-builder.min.js"" type="text/javascript" 
...

• fastspring.builder.secure(): Send the request.

<script>
    fastspring.builder.secure(securedData, secureKey);
</script>

Pass a Secure Request in Test Mode

If you are placing a test order, you do not need to encrypt private information. This allows you to troubleshoot and adapt each payload and encryption.

<script>
    Fastspring.builder.secure(nonEncryptedJSON, '');
</script>

Accepted Fields

The following tables display the fields which can be securely encrypted. Required fields will vary depending on what you include in your JSON string.

Contact Information

Product Information