topic Re: Direct Post Method and SHA-512 upgrade in Integration and Testing

Direct Post Method and SHA-512 upgrade

ezsolcsak — Mon, 28 Jan 2019 20:21:03 GMT

Does anyone know if the x_fp_hash field sent to authorize.net in a POST will need to be updated to use SHA-512 with this upgrade? I understand the response back from authorize.net will now have have an x_SHA2_Hash field but wasn't sure about what I needed to send them initially.

Re: Direct Post Method and SHA-512 upgrade

silentsky — Mon, 28 Jan 2019 20:36:05 GMT

According to this, I would say yes:

https://support.authorize.net/s/article/Do-I-need-to-upgrade-my-transaction-fingerprint-from-HMAC-MD5-to-HMAC-SHA512-and-how?utm_campaign=19Q2%20MD5%20Hash%20EOL%20Developer&utm_medium=email&utm_source=Eloqua

Re: Direct Post Method and SHA-512 upgrade

silentsky — Mon, 28 Jan 2019 20:43:19 GMT

I will add, however, that the recent announcement that went out regarding the impending drop-dead for the MD5 hash specifically mentions it no longer being included in the transaction response. It does not specify whether support for it will also be dropped simultaneously in transaction requests (x_fp_hash). Maybe someone from Authorize.net can chime in on this to clarify if both will happen at the same time.