topic possible ways to make silent post url script secure in Integration and Testing

possible ways to make silent post url script secure

tatvaauthorize — Mon, 07 Sep 2015 06:43:39 GMT

Hello,

anyone know possible ways to make our script to handle authorize silent post url response secure ? if someone knows/ crack our slient post url and try to run manullay from browser or hack script then it may create problem with our system.

can we use HTTP_REFERER or something else to make this happen ?

Thanks!

Re: possible ways to make silent post url script secure

RichardH — Tue, 08 Sep 2015 15:39:39 GMT

Hello @tatvaauthorize

A silent post will always originate from the same IP addresses as documented here: https://community.developer.authorize.net/t5/Integration-and-Testing/Authorize-Net-Relay-Response-Silent-Post-Whitelist-IP-Addresses/m-p/48151/highlight/true#M24281

Richard

Re: possible ways to make silent post url script secure

coppercup — Tue, 15 Dec 2015 15:52:43 GMT

Another method of ensuring that a transaction Silent Post or Relay Response is legitimate and from Authorize.Net is to set an MD5 Hash setting in the Merchant Interface and verify the resulting hash returned in the response. This feature is documented in the AIM and SIM documentation.

We like to verify both the hash and the IP.

Fritz