Support HMAC SHA-512 hash rather than md5 (urgent)

[judgej]

This has kind of crept up unnoticed by me, as I've been busy on other things. Sorry.

The md5 hash is being removed by the end of January 2019. All hashes must now be calculated using SHA-256 hashes. This will be a major version release, where the hashSecret must be replaced with a new key to work, and md5 support is removed completely.

Details on the upgrade here:

https://developer.authorize.net/support/hash_upgrade/

Note: I'm now using release 3.1.0 in production against the DPM API and it is working okay for me. Ultimately DPM, SIM and CIM are all deprecated and will no longer be supported by Authorize.Net at some point in the future, so everyone will need to plan on how to switch over to the generic API API. I'm working on this implementation, but other examples may exist.

[alberto1el]

thank you @judgej I did see that email from authorize.net and wasn't sure if any change was required.

[judgej]

Also noticed the DPM and SIM callbacks do not do a signature check on what is received from the gateway. I think when this was first written, there were no signatures at all. Then there was an md5 signature, and we didn't notice the change, and now that is being withdrawn in preference for the SHA-512 signature (which we don't use anyway - we should though).

TBH the documentation is pretty poorly managed, with mistakes and stuff missing all over the place, so it is easy to miss changes as they happen. Try to find your way to the webhook details from the new API reference? Yes, there are webhooks, and it's not even obvious. I can't find the details without stepping back into Google search. Stuff missing - I was trying to add the driving license model to the payment, and it's not in the docs at all. Makes me wonder what else is missing. Mind, many gateway docs are like this. It's frustrating.

[OnBelayWebSolutions]

@judgej Does this change affect the CIM gateway as well?

[judgej]

@OnBelayWebSolutions Good question, and I honestly don't know. I've never used CIM so have little experience with it. It has just been along for the ride with the other APIs.

If you set a transactionKey as a part of your CIM setup, then it possibly does. This page helps to understand whether you need to upgrade, and CIM is not mentioned, so it likely won't affect you:

https://support.authorize.net/s/article/Do-I-need-to-upgrade-my-transaction-fingerprint-from-HMAC-MD5-to-HMAC-SHA512-and-how

[alberto1el]

I was thinking the same about CIM, and then I thought that well... if the sandbox environment is working shouldn't that be proof that prod should also work?

[judgej]

It gives you 99% confidence, but you never know what differences there are between the sandbox and production. For a start, changes are always rolled out to the sandbox before production, so production does already lag behind the sandbox gateway.

[OnBelayWebSolutions]

@alberto1el Perhaps; ideally they would upgrade the sandbox before the production so that developers can fix issues beforehand but not sure if they do that.

What puts me to rest is the opening sentence from the Do I need To Upgrade-page:

"If you are using our Server Integration Method (SIM) with our Hosted Payment Form, or if you are using the Direct Post Method (DPM), you will need to upgrade ... "

I am only using the Customer Information Manager (CIM) - and since it is not mentioned in the article at all I would be pretty upset if it stopped working end of January.

[judgej]

I'm closing this now, as we have had it running in production for four days, and not had any issues so far. Any problems, please raise a new issue.

[judgej]

Another reminder from Authorize.Net this morning. The linked article is worth reading. Note that this driver does not use signature validation everywhere that it could (or should!) so not all gateway APIs are affected:

---

Dear Developer:

Authorize.Net is phasing out the MD5 based hash use for transaction response verification in favor of the SHA-512 based hash utilizing a Signature Key. If your existing integrations or clients are using MD5 hash, they will need to move to using the SHA-512 based hash. This applies to all Authorize.Net integration methods including the Authorize.Net API, AIM, SIM/DPM and Relay Response.

The end of life for MD5 Hash will be done in two phases:

Phase 1 - Remove ability to configured/update MD5 Hash setting in the Merchant Interface by end of January 2019/early February 2019. This change has no impact to the API response; it will be done in Phase 2.

Phase 2 - Stop sending the MD5 Hash data element in the API response. The date for this change will be announced at a later time but is expected in the next 2-3 months.

For specific details on upgrading to use the SHA-512 hash, please see our support article: MD5 Hash End of Life & Signature Key Replacement.
Thank you for your attention to this matter and for being an Authorize.Net developer.

[jnfaerch]

From Authorize Sandbox support today:

I would suggest reviewing the following to assist with the MD5 Hash upgrade:

https://support.authorize.net/s/article/MD5-Hash-End-of-Life-Signature-Key-Replacement?utm_campaign=19Q2+MD5+Hash+EOL+Developer&utm_medium=email&utm_source=Eloqua

https://developer.authorize.net/support/hash_upgrade/

Soon, our sample codes should be updated to reflect this change. If you do not upgrade the hash, this should not have any effects on your payments. (As we use non-hosted CIM, /jnfaerch)

If you need further assistance, we offer a developer forum where you can interact with other developers that will be able to provide some guidance:

https://community.developer.authorize.net

[eldocherian]

The SIMCompleteAuthorizeRequest will also need to support SHA. If someone is using this now to getdata, their code will be broken.
public function getData()
{
// The hash sent in the callback from the Authorize.Net gateway.
$hash_posted = strtolower($this->httpRequest->request->get('x_MD5_Hash'));

[judgej]

Well spotted

omnipay-authorizenet/src/Message/SIMCompleteAuthorizeRequest.php

Line 24 in c109d81

$hash_posted = strtolower($this->httpRequest->request->get('x_MD5_Hash'));

There are quite a few tests that test md5 hashes too, and need updating. For he record, I don't use SIM and so do not have in-depth experience with it. So if anyone here has code to fix this that they cam submit, then please do so. I'm personally migrating to the JSON API with Accept.JS on the front end, since all the others are clearly marked as deprecated.

[akabuda050]

HI there!
@judgej I added PR - #128. Unfortunately, I don't have time to write tests on it. How can I use this in my project in live?

[alberto1el]

Greetins @akabuda050 you can do it like this:
In your composer.json file add a repositories array (if you don't have it already) at the same level as the "require" object.
like this:

"repositories": [
    {
        "type": "vcs",
        "url": "https://github.com/akabuda050/omnipay-authorizenet"
    }
],

And in your "require" object change the omnipay package to this:

"omnipay/authorizenet" : "dev-issue-123-sim-complete-authorize-request-patch#de5eb0c1358dfe99ae2ab58d4aa1166d0afa7291"

You might need to put it like this:

"omnipay/authorizenet" : "dev-issue-123-sim-complete-authorize-request-patch#de5eb0c1358dfe99ae2ab58d4aa1166d0afa7291 as 3.2.0"

[akabuda050]

Hi @alberto1el,
Thanks! I did it exactly as you described.

[akabuda050]

Is there someone who can write tests on my PR #128 ?

[judgej]

In your reponsitories array you can also use a path entry and point it at a local copy of the package outside the vendors directory. That's probably more suited to development, but it can be useful in production in some special circumstances.

"repositories": [
    {
        "type": "path",
        "url": "../packages/my-package/"
    }
],```

[judgej]

I'll try to have a play with your PR later today and see what tests can be written. Tests will make it easier and safer to refactor, and it would be good to pull the hashing algorithms together for the other gateway methods with this PR.

[akabuda050]

I'll try to have a play with your PR later today and see what tests can be written. Tests will make it easier and safer to refactor...

I see. Thanks!

and it would be good to pull the hashing algorithms together for the other gateway methods with this PR.

I'm not sure what do you mean. Do you mean AIM, DPM, CIM, etc?