title: Paypal MVC3 integration
body: <p><strong>Scenario</strong>
  MVC application with custom shopping cart. Shopping cart integrates with a PayPal, passing sale data like client information, product items and prices (for each item and total price) but not credit card or paypal information. This would be set on paypal.</p>
  
  <p><strong>Problem</strong>
  Paypal describes how to use the cart upload to integrate with custom shopping carts here:
  <a href="https://cms.paypal.com/us/cgi-bin/?cmd=_render-content&amp;content_ID=developer/e_howto_html_cart_upload#id09BLDK0007Q" rel="nofollow noreferrer">https://cms.paypal.com/us/cgi-bin/?cmd=_render-content&amp;content_ID=developer/e_howto_html_cart_upload#id09BLDK0007Q</a>
  But there is very little detail on how to do it.</p>
  
  <p>After a while i found an example of how to do the MVC-Paypal interaction (even though is not cart upload but it is a mater of configuration) here:
  <a href="http://www.arunrana.net/2012/01/paypal-integration-in-mvc3-and-razor.html" rel="nofollow noreferrer">http://www.arunrana.net/2012/01/paypal-integration-in-mvc3-and-razor.html</a></p>
  
  <p>The problem in this solution is that it appears to have some security problems. Sensitive data is set to a view and sent to the client in hidden fields and post is set by javascript, making this unacceptable right? Or am i seeing this wrong?</p>
  
  <p><strong>Intended Solution</strong></p>
  
  <ol>
  <li>User sees shopping car and clicks checkout button, causing a post to <em>myserver.com/Controller/Action</em> passing client data like name, address, etc.</li>
  <li>The controller action <em>myserver.com/Controller/Action</em> builds a post server side, adding the client post data information more sensitive information like prices and paypal merchant specific information and posts request to paypal OR invoques paypal webservice.</li>
  <li>Paypal returns a token, or some other information and <em>myserver.com/Controller/Action</em> redirects client to Paypal to make the payment.</li>
  </ol>
  
  <p><strong>Question</strong>
  Is my intended solution possible? How can i, in response of a post from the client, make some processing in the controller, post/invoke Paypal with the result of that processing and ultimately pass paypals response to the client for him to interact directly with Paypal?
  Otherwise i can't see how it could be "secure".</p>
  
  <p>If not, surely someone have done something similar and can point me into the right direction :-)</p>