Always giving not valid. IT was working before. I did update this code in Starting of Jan-2019 and it worked since then. Please help me out as the issue on production and I cant bear pain of the payment issue.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
**If you find this helpful please kudo this post. This has consumed a huge chunk of my day and you will help me build credibility for when I enroll in the authorize.net certified developer program. **
Here is 100% tested, working php hash verification code for the php SDK. I believe this will also work with SIM/AIM, etc.
You need the following to have an apples to apples setup with what I used:
1: The most recent php SDK package from GitHub. I downloaded this today and installed. I believe it is a few days old.
2: If you have not generated a signature key from your production or sandbox merchant interface to use for testing, do so. You wonโt get the hash in the response without it. Generate it and copy it for use in this script.
3: An API call script for some payment transaction that returns the hash. With the SDK I am getting this for voidTransaction, refundTransaction, capture, etc. I believe that any payment function that directly charges or affects a transaction will contain this. The Accept Hosted form API call obviously does not.
For requirement 1, the SIM/DPM, etc. users do not have this, if my understanding is correct. You should be able to use this as well, only substituting my method for extracting the transHashSha2 value from the response with however you accomplish this using your integration. You may also have to use different parameters in your delimited string, I would try this method first, but I have seen other developers posting attempts with more fields in the string than login, transId, and amount, and there is probably a good reason for this.
Here is the code (p.s. do not follow the hyperlink to the C# byte array description and try to implement a php equivalent to the C# byte array script. This makes things 100X harder than they have to be, as I know well at this point. Without further delayโฆ..)
$login = "copy and paste your merchant login id here"; $signatureKey ="copy and paste your signature key here"; $signatureKey = hex2bin($signatureKey); $amount = $amount; //$response stands for the response object returned by your API call //e.g. $response = refundTransaction($refTransId,$amount,$lastFour); $transId = $response->getTransactionResponse()->getTransId(); $string = '^'.$login.'^'.$transId.'^'.$amount.'^'; $hash = $response->getTransactionResponse()->getTransHashSha2(); $digest = strtoupper(HASH_HMAC('sha512',$string,$signatureKey)); if(hash_equals ($digest,$hash)){ //This if statement is the verification piece //Put whatever you want your app to do with the transaction here //to test you can do something like echo "Hash verification validated"; //or try this: //$dump = print_r($string,true); //$fp = file_put_contents( 'transhash.log', $dump ); //and if your directory populates with a file named transhash.log you know //verification succeeded }
Solved! Go to Solution.
โ01-15-2019 09:04 PM - edited โ01-15-2019 09:13 PM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
โ02-21-2019 10:48 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you @Renaissance ...just to confirm that you were responding to @wenabar16 . This is only my second time posting here in the forums, so I just want to be sure that I'm passing the correct info on to my development. They also want confirmation that this recommendation works for Magento 2x Open Source. Kind regards,
โ02-22-2019 05:36 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It will work for any version of magento that exists, as long as you can edit the code appropriately. And again it is the second code example I posted. I do not use DPM/SIM so I never tested it. Others have tested pretty much identical code and theirs works. Follow the instructions on the code I posted. It looks like you use a different string depending on whether you pass the currency type. I am also not 100% sure if you convert to uppercase. That is also in the instructions on the code. Everything that starts with // is a comment or instructions.
I looked at that extension you posted. That is for accept.js. Thatโs a new method that has nothing to do with DPM. I am not sure if your timeframe for DPM is measured years or more or less. You will get a notification in advance for sure. If I were in your shoes I would get ahead of the curve and get your integration method upgraded ahead of time. The new stuff has a lot of capabilities. Accept.js is thr replacement for DPM. Give me a sec and I will try to find you the sample code that others posted that has been tested, before my food comes out.
โ02-22-2019 09:08 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Look for the post by @cwdsl. They are using the currency in their example. Between my code and this code you should be able to get it working in a short time. I would use hex2bin since youโre on php 7. Base convert worked for them and others have also posted that a pack function worked for them. All of
The values on that example code this person posted tie back to the 2nd code example I gave. So the process that would work easiest would be to try my exact code. If you pass currency in your API call use the version of the string that has currency. Test that. If that doesnโt get a match try it without converting to upper case.
โ02-22-2019 09:21 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you, @Renaissance ! I've shared the details and the recommendations for the different scenarios with my team. I appreciate the follow up. @wenabar16
โ02-22-2019 10:05 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
These lines are incorrect:
$string = "^$login^$sequence^$timeStamp^$amount^"; //the above seems to be what you use if you don't submit //x_currency_code in your request $string2 = "^$login^$sequence^$timeStamp^$amount^$currency"; //looks like you use this if you specify currency
You must remove the first caret to generate a valid fingerprint. My working code looks something like this (strtoupper is not required):
$fpString = "{$id}^{$sequence}^{$timestamp}^{$amount}^{$currency}"; $fp = hash_hmac('sha512', $fpString, hex2bin($signatureKey));
Hope this helps someone...
โ03-04-2019 01:17 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I didnโt have anything to test those on. Just pulled it from the guide. I have working code I will be posting soon to help some folks out. I canโt remember offhand whether I had to convert to uppercase. Seems like I did. Nice catch however....
โ03-04-2019 05:34 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
My original post (first post in this thread) has the code for latest php SDK. Tested on API calls, should work with AIM but hasn't been tested.
Here is the tested code for SIM/DPM. Few notes: First SIM code I posted had not been tested and I in error put an extra ^ at the beginning of the string. The code below is correct and works. For the verification component, this is probably not the best way to do it but it has been tested and works. I do not use these integration methods but finally decided to write a script to test.
//response verification code for DPM/SIM //This code goes on your silent post URL $anetResponse = file_get_contents('php://input'); $response = array( 'x_trans_id'=>'', 'x_test_request'=>'', 'x_response_code'=>'',
'x_auth_code'=>'','x_cvv2_resp_code'=>'', 'x_cavv_response'=>'',
'x_avs_code'=>'', 'x_method'=>'', 'x_account_number'=>'', 'x_amount'=>'',
'x_company'=>'','x_first_name'=>'','x_last_name'=>'','x_address'=>'',
'x_city'=>'','x_state'=>'', 'x_zip'=>'','x_country'=>'', 'x_phone'=>'',
'x_fax'=>'','x_email'=>'', 'x_ship_to_company'=>'', 'x_ship_to_first_name'=>'',
'x_ship_to_last_name'=>'', 'x_ship_to_address'=>'', 'x_ship_to_city'=>'',
'x_ship_to_state'=>'', 'x_ship_to_zip'=>'','x_ship_to_country'=>'',
'x_invoice_num'=>''); $string = '^'; $responseCheck = explode('&',$anetResponse); foreach($responseCheck as $key=> $value){ $newKey = strstr($value,'=',true); $newVal = strstr($value,'='); $newVal = str_replace('=','',$newVal); $newVal = urldecode($newVal); if(array_key_exists($newKey,$response)){ $response[$newKey]= $newVal; } if($newKey=="x_SHA2_Hash"){ $hash = $newVal; } } foreach($response as $key => $value){ $string .= $value .='^'; } $signatureKey = "Copy and Paste Your Signature Key Here."; $signatureKey = hex2bin($signatureKey); $validation = strtoupper(HASH_HMAC('sha512',$string,$signatureKey)); if(hash_equals($hash,$validation)){ //Insert code to be executed if response //is validated here. } //end of response verification //sha512 transaction fingerprint for DPM, SIM date_default_timezone_set('UTC'); //^may not be necessary depending on your configuration $login = "Copy and Paste your Login Here"; $signatureKey = "Paste Signature Key Here"; $signatureKey = hex2bin($signatureKey); $amount = "43.23"; //or $amount = $amount //this assumes you have previously assigned the transaction //amount to a variable called $amount in your script $sequence = "123"; //you can use a variety of numbers //example in your docs uses 3 digit numbers $timeStamp = strtotime("now"); $currency = "USD"; //looks like that you only use this //if you specify currency type in your form request //you can use another value if you do things in a different currency //use one of the two strings below. $string = "$login^$sequence^$timeStamp^$amount^"; //the above is what you use if you don't submit //x_currency_code in your request $string2 = "$login^$sequence^$timeStamp^$amount^$currency"; //you use this if you specify currency
$digest = strtoupper(HASH_HMAC('sha512',$string,$signatureKey));
//or
$digest = strtoupper(HASH_HMAC('sha512',$string2,$signatureKey));
//this value is submitted in your request under "x_fp_hash" //Look in the SIM/DPM developer guide on for what "x_" to to use for $sequence, etc. //page 29.
โ03-04-2019 09:39 AM - edited โ03-04-2019 09:42 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please help me out -
I am getting different hash after payment is done usin Authorizenet DPM. It was working before but from last1-2 days it is not working. I am using following function to generate Fingerprint for x_hp_hash -
$signature_key = hex2bin($signature_key); if (function_exists('hash_hmac')) { return hash_hmac("sha512", $api_login_id . "^" . $fp_sequence . "^" . $fp_timestamp . "^" . $amount . "^", $signature_key); } return bin2hex(mhash(MHASH_SHA512, $api_login_id . "^" . $fp_sequence . "^" . $fp_timestamp . "^" . $amount . "^", $signature_key));
and hash compare after payment -
$hashFields = [ $_POST['x_trans_id'], $_POST['x_test_request'], $_POST['x_response_code'], $_POST['x_auth_code'], $_POST['x_cvv2_resp_code'], $_POST['x_cavv_response'], $_POST['x_avs_code'], $_POST['x_method'], $_POST['x_account_number'], $_POST['x_amount'], $_POST['x_company'], $_POST['x_first_name'], $_POST['x_last_name'], $_POST['x_address'], $_POST['x_city'], $_POST['x_state'], $_POST['x_zip'], $_POST['x_country'], $_POST['x_phone'], $_POST['x_fax'], $_POST['x_email'], $_POST['x_ship_to_company'], $_POST['x_ship_to_first_name'], $_POST['x_ship_to_last_name'], $_POST['x_ship_to_address'], $_POST['x_ship_to_city'], $_POST['x_ship_to_state'], $_POST['x_ship_to_zip'], $_POST['x_ship_to_country'], $_POST['x_invoice_num'], ]; $hashString = '^'.implode('^', $hashFields).'^'; $generatedhash = strtoupper(HASH_HMAC('sha512', $hashString, hex2bin($signature_key))); if (function_exists('hash_equals')) { $equals = hash_equals($_POST['x_SHA2_Hash'], $generatedhash); } else { $equals = $_POST['x_SHA2_Hash'] === $generatedhash; } if($equals) { //valid } else{ //not valid }
โ07-11-2019 01:09 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That script looks ok at first glance. You could try moving your hex2bin function out of the hash function and assigning it to a variable. I think one user did that and it helped. Otherwise you may have an issue that is too in depth to solve in a short time on a forum like this. You are free to IM me if you have additional help needed.
โ07-11-2019 05:08 AM