[SOLVED] [#7495] Authorize.net Gateway Not Working (sorta)

Hey,

I've seen the forum posts regarding Auth.net dropping MD 5 Hash. At this point, there is no way to get that hash from Auth.net despite what they might have sent to you all in an email.

So the value remains blank.

Any transaction using CB Subs DOES GO THROUGH to auth.net BUT the site just sits there and spins and spins until it times out. The customer is never informed of the successful transaction and it looks like the gateway has just crashed.

I've changed all the auth.net keys - twice.

Request Timeout

This request takes too long to process, it is timed out by the server. If it should not be timed out, please contact administrator of this web site to increase 'Connection Timeout'.

Is this connected to the hash issue or something else entirely? I certainly have no idea. I'm hoping you do

I did try using DT Register to pay for an event and that worked fine. Gateway sent the transaction to Auth.net and gave me a confirmation so I know this has to be in CB Subs.

Please help.

Mark

I should say that this is Joomla 3.8.12. When I upgraded to 3.9x the entire site blew up and I had to restore it from a backup to 3.8.12.

I have everything else completely up-to-date. Should I try a nightly build with CB Subs if there is one???

www.ocra-dg.org

The long reply time at authorize.net seems to be with the ARB setup http-request for auto-recurring payments. Will look into this tomorrow. The AIM http-request seems quick as always. Those are at their sandbox test server.

I don't have a real account, only a sandbox one, and after having had to wait for the minimal 7 days period to get the first few auto-recurring ARB silent posts from their sandbox server, I see that there is no MD5 anymore but also no SHA2_Hash despite a configured key.

So if you have a sample ARB silent post notification from your CBSubs install from the production server could you please check if you see a populated x_SHA2_Hash POST variable in the CBSubs notifications for the ARB silent post ? On the sandbox server there is no x_MD5_Hash nor x_SHA_Hash variables posted, and according to the auth.net community forum this seems to be a known bug at authorize.net side. The ARB silent posts documentation has simply disappeared on their devleoppers site. So it's hard to debug.

Btw. lack of hash in ARB is weaker than using MD5 (especially that those silent posts are never exposed to users, and thus the hashes are not exploitable to guess the key, so MD5 was not a major issue for silent ARB posts).

We will release a CBSubs nightly soon that allows to leave the MD5 key field empty and in that case to skip that verification (like most subscriptions systems have done it), so that sites can continue working until either authorize.net sorts out their lack of hash, or customers find an alternative payment processor for their sites.

Btw, tbh, looking at the authorize.net handling of customers, developers, and of the bugs in the transition, and handling of these situation by authorize.net, for now, I can unfortunately not recommend authorize.net as a payment gateway anymore right now.

Beat,

Thanks for the quick response. This is obviously causing no end of grief for my clients (and you know what rolls downhill and where it lands :dry:)

I don't have any sample ARB silent post notification information for you but I will leave a superuser login for you to check yourself if you wish.

Any timeframe for the nightly release? I'd like to get this resolved soonest.

Just FYI, I can't recommend to my clients that they dump Auth.net - they use it for many other things. I think what they (authnet) did was high-handed but realistically there isn't a lot of blowback they'll get for it.

Thank you for your time.

Mark

This sudden very long delay is most probably caused by Authorize.net (CBSubs is just doing a http request to authorize.net, and it hangs there for minutes), and is most probably a different issue of their single-handed MD5 removal.

I have seen this for ARB auto-recurring payments on the test server. But it seems that you are only using single payments and still experiencing it ?

I'll try to reproduce your problem, which is yet different, find if there is a way to work around it. But your customer should complain at authorize.net for this sudden extremely slow and business-killing delay.

Just as reference, authorize.net has been working with CBSubs for over 8 years without such issues, and nothing in that gateway changed since around 5 years, so it's quite obvious that the recent changes at authorize.net are cause of this sudden headache.

I can't give a resolution delay, as the problem originates at authorize.net, but it is my current high-priority task.

Beat,

Thanks for your attention to this.

Yes, I am only using single payments.

I know that the payment gateway has been solid. I've used CB Subs on other websites in a similar configuration to this for five years with no issues.

I have complained to Authorize.net on behalf of my client. They are clear on my feelings. I am not one to keep silent on something like this.

Looking forward to the nightly build.

Many thanks,
Mark

P.S. Some random thoughts: I was having issues with the SSL cert on this site. There was a conflict with DT Register's FORCE SSL plugin. I disabled the plugin and now everything works (supposedly) as it should.

Also, I was having session issues. I was getting this message on all browsers on my end: Session expired or cookies are not enabled in your browser. Please press "reload page" in your browser, and enable cookies in your browser. Please refresh/reload page before filling-in.\

I had to shut down anti-spoofing in order to access anything in CB or CB Subs.

Just more info if it helps.

I have the server SSL raw access log if that helps. I can tell you my IP and you can find the instances in the log where I tried again today to register and the spinner thingie timed out.

Let me know how best to send it if you need it.

Mark