topic Re: Create Customer Profile requests with emails containing a + symbol return E00013 "email is in Integration and Testing

Create Customer Profile requests with emails containing a + symbol return E00013 "email is invalid"

jantzenw — Thu, 29 Mar 2018 15:54:13 GMT

Create Customer Profile requests with emails containing a + symbol return E00013 "email is invalid"

Request without error: http://www.screencast.com/t/a5sxNsEn

Request with error: http://www.screencast.com/t/RZPbDcl57S

Request and response without error: https://gist.github.com/jantzenw/cf672ec18b36ac069109dcb452a2d525

Request and response with error: https://gist.github.com/jantzenw/a65636cd78f9757b5eb1222dd63766d5

The first instance of this error was today at 2018-03-29T14:23:40+00:00.

It is critical that the email validation be updated to allow + symbols because this is a valid email character: https://support.google.com/mail/answer/22370?hl=en#alias. This is commonly used in testing to allow multiple accounts to share the same inbox.

Re: Create Customer Profile requests with emails containing a + symbol return E00013 "email is

jantzenw — Thu, 29 Mar 2018 17:19:57 GMT

Authorize.net support gave this reply:

'I've reached our to our developers and engineers, since this is a highly unusual question. They have confirmed that our system does not allow that character, and that this is an intentional decision. They provided the following reason as an explanation of why that decision was made:

"It is a security issue. We do not allow the special characters so that hackers cannot do SQL injection in the field"

I'm sorry for any inconvenience, but I hope this information helps.'

Re: Create Customer Profile requests with emails containing a + symbol return E00013 "email is

bryankacz — Thu, 29 Mar 2018 18:02:56 GMT

It seems as this has just changed today with little to no notice for developers. It has taken down our systems at 3 of our retail locations due to the fact that we utilize the + sign in an email to insure a unique address when creating a customer.

Re: Create Customer Profile requests with emails containing a + symbol return E00013 "email is

mfiedel — Thu, 29 Mar 2018 22:18:51 GMT

This is negatively affecting our ability to QA our staging environment because we use the ability to add a "+" to establish aliases for testing, without needing to create a unique email address everytime.

The lack of communication on this update by Authorize.net is frustrating.

Re: Create Customer Profile requests with emails containing a + symbol return E00013 "email is

matth — Fri, 30 Mar 2018 21:12:17 GMT

We're also having the same issue starting yesterday.

Many of our customer's accounts have a valid + in the email address and the payments are now getting this error when trying to place an order.

Re: Create Customer Profile requests with emails containing a + symbol return E00013 "email is

schmich — Fri, 30 Mar 2018 21:22:04 GMT

This change is unacceptable.

Everything jantzenw mentioned about validation is correct. In addition, see this StackOverflow answer with multiple references to IETF RFCs. "+" is absolutely a valid email address character.

> It is a security issue. We do not allow the special characters so that hackers cannot do SQL injection in the field

I appreciate that there might be Authorize.net internal implementation details I'm unaware of, but this statement in general is misleading and should not be considered a valid reason for rejecting "+". Using SQL prepared statements or any openly available libraries to properly escape queries prevents injection.

As jantzenw mentioned, we also use "+" in emails in development and testing in order to have unique email addresses while still having a shared inbox. Furthermore, it's a common practice for privacy-minded folks to include the site's domain in their email when registering, e.g. "user@gmail.com" becomes "user+domain@gmail.com".

I sincerely hope this change will be reverted.

Re: Create Customer Profile requests with emails containing a + symbol return E00013 "email is

RichardH — Sat, 31 Mar 2018 14:38:20 GMT

Hello @schmich @jantzenw @matth @mfiedel @bryankacz

We've escalated your report to our product team. We'll post updates to this thread when we receive them.

Richard

Re: Create Customer Profile requests with emails containing a + symbol return E00013 "email is

knightcode — Sat, 31 Mar 2018 18:10:46 GMT

Just ran into this problem as well..... and I have so many doubts about your development process now. How did no one know the '+' symbol was part of a valid email address? How did no one catch this problem in review? How the hell were you still vulnerable to SQL injection attacks?

Why the **** do you even need a uniqueness constraint on the email field? Who cares what email our system gives yours for a new account. The customer can't log into yours. The ID's the only thing that matters.

Re: Create Customer Profile requests with emails containing a + symbol return E00013 "email is

knightcode — Sat, 31 Mar 2018 20:37:20 GMT

You're also flagging the single quote, presumably for the same SQL injection attack reason, but this, too, is a valid character in an email address.

Reference: https://en.wikipedia.org/wiki/Email_address#Syntax

Re: Create Customer Profile requests with emails containing a + symbol return E00013 "email is

Vikas_chauhan — Mon, 02 Apr 2018 15:24:55 GMT

I am also facing the same issue

can anyone help?

Re: Create Customer Profile requests with emails containing a + symbol return E00013 "email is

eweblife123 — Mon, 02 Apr 2018 16:08:56 GMT

Please note, many spouses share emails and use the + sign to create unique logins for systems and other purposes. Gmail and some other providers allow this usage.

Re: Create Customer Profile requests with emails containing a + symbol return E00013 "email is

chsriniv9 — Mon, 02 Apr 2018 18:44:00 GMT

Hi Matth,

Could you please share more details about the payment flow and at what point you are getting error when trying to place order.

Regards,

Chethan

Re: Create Customer Profile requests with emails containing a + symbol return E00013 "email is

matth — Mon, 02 Apr 2018 19:17:56 GMT

Hi Chethan,

This is just with WooCommerce and the standard Authorize.Net plugin: https://docs.woocommerce.com/document/authorize-net-cim/

Whenever a customer tries to place an order and their Email address for their WooCommerce account has a + character in it this error "Code: E00013, Message: email is invalid." is returned.

Removing the + from their account and it works fine.

Matt

Re: Create Customer Profile requests with emails containing a + symbol return E00013 "email is

maestrojed — Tue, 03 Apr 2018 05:47:46 GMT

Us too.

A plus sign is valid character in an email according to any standard. It is used by, allowed and recommended by some of the largest providers.

We are receiving multiple errors because of this, in production....

Re: Create Customer Profile requests with emails containing a + symbol return E00013 "email is

TSeale — Tue, 03 Apr 2018 15:23:37 GMT

Please provide frequent updates to this issue. This is wreaking havoc on our testing as we've developed automation scripts that use this technique.

Re: Create Customer Profile requests with emails containing a + symbol return E00013 "email is

denis8475 — Tue, 03 Apr 2018 16:25:28 GMT

Hi,

We use Authorize.net as a payment gateway with Chargify.com. We are also affected by this change. Like others who have replied, we rely on using "+" in email addresses to create unique email addresses for a shared inbox, to facilitate our development and QA processes.

Please consider rolling back this change to allow us to use "+" in our email addresses again.

Thanks,

Denis

Re: Create Customer Profile requests with emails containing a + symbol return E00013 "email is

asolomon — Tue, 03 Apr 2018 22:57:41 GMT

Like many of the other commenters, I too run a website that relies on the "+" symbol in email addresses. This unexpected change to the API has badly crippled our website and we are struggling to quickly correct our schema. Please revert the change, it is a valid character and many of the largest email providers support and encourage its use.

Re: Create Customer Profile requests with emails containing a + symbol return E00013 "email is

DoveChris — Tue, 03 Apr 2018 23:24:50 GMT

This change has really affected our sales website and the accounts we use. Can we get it reverted? It seems like a really major change to happen with no notice.

Re: Create Customer Profile requests with emails containing a + symbol return E00013 "email is

clincoln — Tue, 03 Apr 2018 23:32:27 GMT

I work for a large company that relies on the "+" symbol in emails and we are being negatively impacted by this change. This change makes absolutely no sense since "+" is a valid character that is widely used by people and businesses. Please change back to allow this symbol ASAP!

Re: Create Customer Profile requests with emails containing a + symbol return E00013 "email is

ksanborn — Tue, 03 Apr 2018 23:34:42 GMT

We’re also encountering problems with this change, we rely on using “+” for email addresses in our system and this is creating significant support issues for us. It's an awfully significant update to issue with no warning. When can we expect to see this corrected?