confirmCardPayment() fails with 400 Bad Request

[aniongithub]

Summary

The confirmCardPayment() method in localstripe's JavaScript client fails with a 400 Bad Request error when processing payments that require 3DS authentication. This affects the standard Stripe payment flow and prevents successful payment completion.

Environment

• localstripe version: latest (docker container)
• Browser: Chrome 140.0.0.0 on Linux
• Test card: 4242424242424242 (standard Stripe test card)

Steps to Reproduce

1. Create a PaymentIntent via the API
2. Use Stripe().confirmCardPayment() with any card number (even non-3DS cards trigger authentication unexpectedly)
3. Complete the 3DS authentication popup that appears
4. Observe 400 Bad Request error

Expected Behavior

• Non-3DS cards like 4242424242424242 should complete without authentication
• 3DS cards should complete successfully after authentication
• Webhooks should fire upon successful payment

Actual Behavior

• All cards trigger 3DS authentication (unexpected for 4242424242424242)
• Authentication fails with 400 Bad Request
• Payment never completes
• No webhooks are fired

Logs

localstripe container logs:

::ffff:172.24.0.8 [19/Oct/2025:06:24:53 +0000] "POST /v1/payment_intents HTTP/1.1" 200 860 "-" "Stripe/V1 .NetBindings/47.0.0"
::ffff:172.24.0.8 [19/Oct/2025:06:24:53 +0000] "GET /v1/payment_intents/pi_VW7ht0vF2JtFyD HTTP/1.1" 200 860 "-" "Stripe/V1 .NetBindings/47.0.0"
::ffff:172.24.0.1 [19/Oct/2025:06:24:55 +0000] "POST /v1/payment_intents/pi_VW7ht0vF2JtFyD/_authenticate?success=true HTTP/1.1" 400 418 "http://localhost:8888/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36"

Client-side logs:

Creating payment intent for amount: 10
Payment intent created: pi_VW7ht0vF2JtFyD
localstripe: Stripe().confirmCardPayment()
POST http://localhost:8420/v1/payment_intents/pi_VW7ht0vF2JtFyD/_authenticate?success=true 400 (Bad Request)
Payment confirmation error: {message: 'Bad request', type: 'invalid_request_error'}

[aniongithub]

I have written what I believe to be the root cause below. I'd be happy to submit a PR if this is indeed the issue, otherwise please feel free to correct my understanding

Root Cause Analysis

After investigating the code, the issue appears to be in localstripe-v3.js. The confirmCardPayment() method skips the required /confirm API call and goes directly to /_authenticate, causing a status mismatch:

1. PaymentIntent starts in requires_confirmation status
2. confirmCardPayment() calls /_authenticate directly (line ~349 in localstripe-v3.js)
3. /_authenticate expects status to be requires_action but finds requires_confirmation
4. This triggers the 400 Bad Request error in PaymentIntent._api_authenticate() (resources.py:2127)

Code References

• Issue location: localstripe/localstripe-v3.js - confirmCardPayment() method
• Error location: localstripe/resources.py:2127 - status validation in _api_authenticate()
• Expected flow: /confirm → requires_action → /_authenticate → succeeded
• Actual flow: /confirm skipped → /_authenticate called on requires_confirmation status