omnipay-authorizenet icon indicating copy to clipboard operation
omnipay-authorizenet copied to clipboard

Check format of transaction response before using it

Open judgej opened this issue 9 years ago • 0 comments

This is as a result of issue #30 where the transaction to Authorize.Net was being sent through another device and library, but the notify/callback was being handled by OmniPay. It turns out there are alternative transaction response formats that can be sent in this instance, but which OmniPay does not realise and ends up declaring the transaction as authorised.

To be valid, the first field of the response MUST be "1", "2", "3" or "4". Any other value should raise an immediate exception. A value of "1.0" is the normal response when the transaction was sent via a card reader.

This isn't urgent or something that will affect many people, but when it does, the results can be very misleading, resulting in expired cards being declared as authorised.

judgej avatar Jan 06 '16 15:01 judgej