newbie security question

aj23 — Wed, 05 Oct 2011 23:02:04 GMT

I'm a mechanical engineer and a client asked me to implement authorize.net on a site because their web developer wouldn't (weird). After deciding to use AIM, I downloaded the VB.net sample code (ASP.net 3.5) because that's what I am used to and it works well. I noticed other people asked similar questions but I just wanted to make certain this is the correct method.

In the example code, the api login id and transaction key are saved in the Visual Basic code-behind page. Since no one mentioned it, I am guessing that hackers can't access this code-behind page. Is that correct?

I've been reading up on other ways to secure an asp.net site, but this was a big unknown for me.

Thanks for your help,

Re: newbie security question

RaynorC1emen7 — Wed, 05 Oct 2011 23:39:25 GMT

As long as the id and key is not render to the page. For example, don't put it on a label or textbox, even if is hidden(non-display). Then, they won't get send to user(customer) browser.

As far as hackers can't access this code-behind page. If the hackers gain access to the server, anything is possible.

There is PCI standard you might want to read too.

http://community.developer.authorize.net/t5/The-Authorize-Net-Developer-Blog/PCI-and-You/ba-p/10628

For AIM, the web site need to have SSL for the payment page. If they don't have it, SIM or DPM is the other option.

topic newbie security question in Integration and Testing

newbie security question

Re: newbie security question