To give a context for my question, we are actually migrating to Magento from Interspire Shopping Cart. In Interspire, the payment form would be displayed after everything else, especially the Order Review/Summary. At this last step of the checkout, we just display an iframe, which displays a payment form hosted on our payment gateway's server (since we're not PCI compliant). In Magento, however, the last part isn't the payment form, but the Order Review.
So my question is, would it be possible at all to create a payment method that uses an iframe (instead of redirecting to a payment page after "Place Order" is clicked)? This iframe would display the payment form hosted on our payment gateway's server.
I ask this because based on what I've read, and after playing with my code, it seems that it is not possible in Magento. Displaying this iframe, for example, on Step 4 (Payment Information) would mean that when the form is filled out and submitted by the user, the page would redirect to a success page, thereby bypassing Step 5 (Order Review). And even this won't work because it is actually in Step 5 (after Place Order is clicked) where the success page is even defined. So after submitting the payment form (in an iframe) in Step 4, it wouldn't know what to do next.
I also tried to research how to put this iframe in Step 5 instead of Step 4, having it appear after "Place Order" is clicked, but couldn't find anything.
So, is it possible to create an iframe-based payment method in Magento? If so could you point me to some resources, because I've googled a lot and haven't found anything useful.
Best Answer
Good news:
This is actually already available. It's called Magento Payment Bridge which integrates an iFrame into the payment process so that the payment doesn't take place on your own server.
Here is some more information about Payment Bridge:
http://www.magentocommerce.com/company/pci-compliance
http://www.magentocommerce.com/images/uploads/Magento_Secure_Payment_Bridge.pdf
Bad news:
It's not available standalone. It used to be available via Magento Professional, which was a smaller version of Magento Enterprise (limited features, less cost, no online support). Now it seems it is exclusively an Enterprise feature.
If you're not in the market for EE, you're probably left to roll your own. Some payment providers do this already:
Other options
Look into some of the newer companies that are doing payments like Stripe. Stripe has an amazing payments API that is dead-simple and will not require iframing. They even have a javascript include API.
Other competitors of Stripe include Authorize.net (who have a Javacript API now) and Braintree.