Authorize.net POST vs GET methods.

-- HikaShop version -- : 2.6.3
-- Joomla version -- : Joomla! 3.5.1 Stable
-- PHP version -- : 5.4.45
-- Browser(s) name and version -- : Chrome Version 50.0.2661.94 m
-- Error-message(debug-mod must be tuned on) -- : No error msg

I apologize if this is a redundant question.
I have searched Hikashop docs and forums to find
Authorize.net POST vs GET methods.

Please point me in the right direction?
I know that you must have fixed/changed this already.
I searched the update version changes lists too, but see no mention of this.

We have this email from Authorize.net
---
Dear Authorize.Net Merchant:
During a system scan, we noticed that your website or payment solution is using the HTTP GET method when submitting your transaction requests to secure.authorize.net/gateway/transact.dll .

Because HTTP GET methods do not adhere to current TLS protection requirements, Authorize.Net will not allow HTTP GET methods for transaction requests as of June 30, 2016. We recommend that you immediately update your code to use the HTTP POST method instead.

Any transaction request submitted using HTTP GET after June 30th will be rejected.

Please contact your Web developer or solution provider for assistance, or check out our Certified Developer Directory at www.authorize.net/cdd to find a developer to help you.

If you have already made these changes, please disregard this message. If you have any questions about this email, please contact Customer Support.

Thank you for your attention to this matter and for being an Authorize.Net merchant.
---

DO I need to make a change in the Authorize.net payment method settings ?

Thank You !
Kent Morrison
kent@steamboat3d.com

Hi,

I've checked your website and it seems that you're using the AIM mode. For the SIM mode it's 100% sure that we're using a POST.
For the AIM mode, we thought that we were, but apparently the line:
curl_setopt($request, CURLOPT_POST, true);
is necessary before the line:
curl_setopt($request, CURLOPT_POSTFIELDS, $post_string);
in the file plugins/hikashoppayment/authorize/authorize.php to force a POST in all cases.
So please add that and then check with them that it is now ok.

Nicolas,
Thanks very much for this response.
I do not mind adding code to the extensions, but please tel me:

Would I be better off using the SIM mode method anyway ?
Is it more secure?
And wouldn't future Hikashop updates overwrite my changes to the AIM method code ?
I'm looking for the most stable and foolproof method to resolve this.

Also, If I do add this code, please tell me exactly what file to modify ?

Please let me know.
Thank you !

Regards,
Kent

Hi,

The SIM mode is more secure for your customers credit card data, but the AIM mode has a better conversion rate. So it's your call.
The change would be lost in future features if we didn't add that change as well on our end and we plan to add it to the next release. Especially if you can confirm that it works fine.
I told you what file to modify already: plugins/hikashoppayment/authorize/authorize.php

I'll make the code change and test it, then confirm for you that it works OK.
Then if you want to include it in a future release, you'll have some confirmation that it works.

I'm going to try to do it with an override file, so that it won't get blown away in the next update.
Do you think that an override file will work for plugins/hikashoppayment/authorize/authorize.php ?

thnx
Kent

Hi,

No, you need to modify directly the file. But don't worry with the updates. If you just tell us that it works for you, the modification will be incldued on our end and you won't have to do anything when you update.

Nicolas,
per your guidance:

in file /public_html/plugins/hikashoppayment/authorize/authorize.php
PREVIOUS CODE from line 97-103
CHANGED TO:
and we are testing sales transactions today, and then going back to Authorize.net for confirmation that it conforms to their new standards.

I will report back degree of success with this solution.
Thanks very much
Kent

After using the method outlined above we have used the plugin successfully for several transactions and all appears to work, and the Authorize.net folks have said that it appears to work from their perspective.

Thanks very much for your help !

Kent

Hi,

Thank you for your feedback. The modification has been included on our end.