Invalid notification with authorize plugin payment

-- url of the page with the problem -- : secure.authorize.net/gateway/transact.dll
-- HikaShop version -- : 6.6.0
-- Joomla version -- : 6.1.3
-- PHP version -- : 8.3.33
-- Error-message(debug-mod must be tuned on) -- : Invalid notification

Hello,

Thank you for your component. It is very well designed and greatly appreciated.

I am experiencing an issue with the Authorize.Net payment plugin in SIM mode.

The payment is successfully approved and captured by Authorize.Net. However, when the response is sent back to HikaShop, the following message is displayed:

“Invalid notification.”

The HikaShop order is then automatically changed from “Created” to “Cancelled,” even though the transaction was successfully approved by Authorize.Net.

The debug log confirms the following:

* x_response_code = 1
* x_response_reason_text = This transaction has been approved
* x_SHA2_Hash is present
* x_MD5_Hash is empty
* The correct order is identified through x_po_num
* The amount and currency are correct

I have completed the following checks:

* The Signature Key contains exactly 128 hexadecimal characters.
* It does not contain spaces, line breaks, quotation marks, or a 0x prefix.
* The Signature Key was removed, entered again, and saved.
* The MD5 Hash field is empty.
* The same Signature Key works successfully with Odoo using the same Authorize.Net account.
* I tested the transaction without accented characters in the address, but the notification was still rejected.
* The Authorize.Net Response/Receipt URL is correctly registered.
* The response successfully reaches HikaShop and the correct order is loaded.

I also receive the following PHP warnings:

Warning: Undefined property: plgHikashoppaymentAuthorize::$payment_params in plugins/hikashoppayment/authorize/authorize.php on line 360

Warning: Attempt to read property "debug" on null in plugins/hikashoppayment/authorize/authorize.php on line 360

At the beginning of the onPaymentNotification() function, the following property appears to be accessed before the payment parameters are loaded:

if($this->payment_params->debug)

The payment parameters appear to be loaded only later, after the order number has been obtained:

$order_id = (int)@$vars;
$dbOrder = $this->getOrder($order_id);
$this->loadPaymentParams($dbOrder);

Could you please confirm whether there is a known issue with the SHA-512 hash calculation or validation in the Authorize.Net SIM plugin and provide the appropriate secure patch if necessary?

I do not want to disable SHA-512 validation. I can provide a sanitized payment log and the relevant sections of the authorize.php file if needed.

Thank you very much for your assistance.

Micheline

Hello,

You are right about the warning you found. The plugin read its debug setting before loading the payment parameters, so on PHP 8 it produced that warning and, more importantly, the data Authorize.net posts back was never written to the payment log. That is fixed and the raw notification is logged again when the debug mode is on.

For the rejection itself, the most likely cause is the character encoding. Authorize.net builds the SHA-512 on the ISO 8859-1 form of the values while it posts them back to your website in UTF-8, so a single accent in the first name, last name, company, address, city, state or country is enough to make the hash impossible to reproduce, and the notification is then refused and the order cancelled. The plugin now also compares against the ISO 8859-1 form, which should let your approved payments go through.

Both changes are in the 6.6.0 package. Please re-download HikaShop 6.6.0 from your account on our website and install it over your current installation. The version number does not change, only the build number, which is the number between brackets next to the version on the first tab of the HikaShop configuration page: it has to be 2609201331 or later.

If a payment is still refused after that, the plugin now writes to the payment log the exact string it built the hash on. Please turn the debug mode of the plugin on, run one transaction, and send us that line together with the received hash and the calculated hash from the notification email, and we will be able to tell which field differs.

Hello,
I installed build 2609201331, enabled debug mode and performed another transaction. Unfortunately, HikaShop still displays “Invalid notification” and cancels the order, although Authorize.Net approved the payment.
The payment log contains the received and the “Authorize.net hashed string,” but I cannot find the calculated hash. I also did not receive the technical email containing the received and calculated hashes.
Could you please tell me where I can find the calculated hash?
I can send you the relevant log entries privately if needed.
Thank you,
Micheline

Hi,

The most common cause of this exact mismatch is that the Signature Key saved in the Authorize.net payment method of HikaShop no longer matches the current Signature Key shown in your Authorize.net account, under Account > Security Settings > General Security Settings > API Credentials & Keys. Re-copying it from there into the plugin's configuration and saving should resolve it; please try another test transaction after that and let us know if the notification is still refused.

Regarding the calculated hash, while looking at what you described, we made some improvements on the debug handling when a hash mismatch happens. We've made a new build of the 6.6.0 with the modifications. So, you can download the install package of HikaShop on our website and install it on yours in order to get them. You should then directly have the information you seek in the payment notification email sent to you when the problem happens.

Hello,

Great news! I installed the latest build and performed another test transaction. The payment was successfully approved by Authorize.Net, and the HikaShop order was automatically confirmed.

The issue is now resolved.

Thank you very much for your help and for making the necessary improvements.

Micheline