Cybersource Payer Auth未返回跳转URL，3DS测试卡始终返回challengeRequired:N

我正在为Web应用集成Cybersource Payer Authentication。完成payer auth请求配置与Cardinal Cruise数据收集iframe后，获取参考编号并调用/risk/v1/authentications接口检查payer auth注册状态，但始终未收到用于重定向客户获取OTP的step-up URL，所有3DS测试卡均返回"challengeRequired": "N"响应，接口返回状态为PENDING_AUTHENTICATION。

请求载荷 #

{
  "clientReferenceInformation": {
    "code": "1687150893566"
  },
  "orderInformation": {
    "amountDetails": {
      "currency": "USD",
      "totalAmount": "2160"
    },
"billTo": {"address1": "1 Market St","address2": "Address 2","administrativeArea": "CA","country": "US","locality": "san francisco","firstName": "John","lastName": "Doe","phoneNumber": "4158880000","email": "test@cybs.com","postalCode": "94105"}},  "paymentInformation": {
    "card": {
      "expirationMonth": "01",
      "expirationYear": "2026",
      "number": "5200000000001096"
    }
  },
  "consumerAuthenticationInformation": {
    "returnUrl": "https://master.d2ujgj4n2ay0ce.amplifyapp.com/",
    "referenceId": "6bd4c575-43dd-4e59-accd-0b4cb9beddcc"
  }
}

响应载荷 #

{
  "clientReferenceInformation": {
    "code": "1687150893566"
  },
  "consumerAuthenticationInformation": {
    "challengeRequired": "N",
    "authenticationTransactionId": "RyQDKyiLvTsIXoONt2i0",
    "strongAuthentication": {
      "OutageExemptionIndicator": "0"
    },
    "token": "AxjzbwSTdIFZtk0sPtKZABICURzC5rNzpBLS8AxhXa0ky9GLCALUBcAADiOC",
    "acsUrl": "https://0merchantacsstag.cardinalcommerce.com/MerchantACSWeb/creq.jsp",
    "acsReferenceNumber": "Cardinal ACS",
    "pareq": "eyJtZXNzYWdlVHlwZSI6IkNSZXEiLCJtZXNzYWdlVmVyc2lvbiI6IjIuMS4wIiwidGhyZWVEU1NlcnZlclRyYW5zSUQiOiI5NDI2ZjNjOC1lNWJjLTRiZGItYThkMi1jYzg3YWZhN2M1YmEiLCJhY3NUcmFuc0lEIjoiMjRiYjI0NmItMmJlMi00OGNiLWEzMjAtZmNjYTE1NmExZDUzIiwiY2hhbGxlbmdlV2luZG93U2l6ZSI6IjAyIn0",
    "directoryServerTransactionId": "42bdad76-5f37-46cb-a106-3c74cd1d4183",
    "veresEnrolled": "Y",
    "threeDSServerTransactionId": "9426f3c8-e5bc-4bdb-a8d2-cc87afa7c5ba",
    "acsOperatorID": "MerchantACS",
    "specificationVersion": "2.1.0",
    "acsTransactionId": "24bb246b-2be2-48cb-a320-fcca156a1d53"
  },
  "errorInformation": {
    "reason": "CONSUMER_AUTHENTICATION_REQUIRED",
    "message": "The cardholder is enrolled in Payer Authentication. Please authenticate the cardholder before continuing with the transaction."
  },
  "id": "6871509476766344204953",
  "paymentInformation": {
    "card": {
      "bin": "520000",
      "type": "MASTERCARD"
    }
  },
  "status": "PENDING_AUTHENTICATION",
  "submitTimeUtc": "2023-06-19T05:02:27Z"
}

排查方向 #

• 更换测试卡：当前使用的测试卡可能默认走无摩擦（frictionless）流程，需改用Cybersource官方文档中明确标记为需要挑战的测试卡号，确保触发OTP验证场景。
• 校验Cardinal Cruise数据收集：确认iframe已完整收集设备、浏览器等必要数据，且请求中的referenceId与iframe返回的编号完全一致，数据缺失可能导致ACS判定无需挑战。
• 补全3DS2参数：响应显示使用3DS 2.1.0版本，检查请求是否遗漏deviceInformation、browserInformation等3DS2必填参数，这些参数会影响挑战决策逻辑。
• 调整商户后台配置：登录Cybersource商户后台，确认是否开启了强制挑战规则，部分商户默认允许无摩擦流程，需修改配置强制触发挑战测试。
• 处理ACS重定向：即使challengeRequired为"N"，但接口返回PENDING_AUTHENTICATION状态，仍需用响应中的acsUrl和pareq参数构建表单，将用户重定向到ACS完成静默认证，而非直接跳过认证步骤。

内容的提问来源于stack exchange，提问作者Nirodya Gamage