We have an online store with a few hundred products, and we'd like to streamline the checkout & payment process.
Currently our payment processor requires the website to be redirected to their site to make the payment, then the user is redirected back to our site for confirmation.

Instead of redirecting our users to the payment processor's site, can we open the payment processor's site in a popup? I think the popup could either be a separate window (though that might be extra complicated), or as a lightbox (possibly using an iframe).

Does Drupal Commerce support this sort of thing, and is it safe to do or not recommended (as a security risk)?

We're using Drupal 7. Our site is a fairly standard online store.

2 Answers 2


If your gateway tells you to redirect, you redirect. If you need a modal-based gateway, choose another gateway. Changing the flow recommended by your gateway puts you firmly in unsupported waters, and definitely exposes you to additional risk. This is especially true since redirected gateways require PCI A compliance, while modals require the slightly more complex PCI A-EP compliance.

I would also expect most gateways to have protection against this.

  • Does this also apply when opening the payment processor's webpage in an iframe or new window? Commented Jan 18, 2017 at 13:39
  • For an iframe, definitely. Don't know about new window. Commented Jan 19, 2017 at 12:07

Yes it can be done in pop-up/iframe. But that would require development of custom form to take card info & send to payment gateway for further authentication & processing..

Some valuable information available here - https://drupalcommerce.org/user-guide/payments. There is a module authorize.ent shown in the example on this page which enable on-site payment. You can take help from that module's code.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.