authenticationssllocalhostamazon-pay

Amazon Pay Sandbox Error when trying to login on localhost - "Scheme not HTTPS"


I am trying to integrate Amazon Pay for a web shop. The login button is displayed correctly but as soon as I login with my sandbox account credentials to show the address widget I get the following error in my Chrome dev tools console: [Amazon.error] attempted redirect to http://myownvirtualhost.local/shop.html?... but scheme is not HTTPS. So the error is obvious but how do I fix this? After login the redirect is supposed to happen on a HTTPS url but as already mentioned I am developing on my localhost with a configured virtual host. I also use the correct (EU) sandbox Widget.js file and set sandbox mode to true in my PHP configuration.

My code:

OffAmazonPayments.Button('amazonPayButton', 'MERCHANT-ID', {
                type:  'PwA',
                language: 'de-DE',

                authorization: function() {
                    loginOptions = {scope: 'profile postal_code payments:widget payments:shipping_address', popup: true };
                    authRequest = amazon.Login.authorize(loginOptions, 'http://myownvirtualhost.local/shop.html?action=cart');
                },
                onError: function (error) {
                    console.log('auth request: ' + error.getErrorCode() + ': ' + error.getErrorMessage());
                }
            });

I didn't provide my merchant id as this is an example. So my redirect url has HTTP as scheme and this is the cause of the error. I am confused because after reading the registration chapter of the Amazon Pay Integration guide I thought SSL is not relevant on localhost. From the integration guide:

Obtain an SSL certificate. Your server is required to have a valid SSL certificate issued by a trusted Certificate Authority. Note: When working in a "localhost" environment, an SSL certificate is not required. For more information, see SSL certification.

Any help is appreciated. Thanks in advance!


Solution

  • I suppose "localhost" is supposed to be taken literally as the default "http://localhost" domain.

    If you would like to stick with your virtual host, there are two options:

    1. Install a local SSL certificate for it (there is a lot of guides for this here on SO and out there in the internet)
    2. Set the return URL to "https://myownvirtualhost.local" even without a certificate installed. Your browser will show an error. Modifying the address to "http://" will do the trick. This is not very elegant but should be good enough for development purposes.