After a bunch of researching, it's way more clear to me what's going on. There are several confusions regarding this, mainly for merchants still using Magento 1. These confusions arise from the fact that Magento 1 has 2two different Auth.net payment methods for auth.net**: Authorize"regular" auth.net, and AuthorizeDirect Post auth.net, while Magento 2 only offers the Direct Post**Post method. It's not clearBecause of this new understanding, I completely changed the question that I originally asked, trying to me ifmake the MD5 change explained in these 2 links will affect both payment methodssituation more clear to anyone that encounters this. For a simplified overview of just the Direct Post methodsituation, check Esco INC's answer bellow.
MagentoSummary:
A merchant using Magento 1 and Auth.net payment method Link(not the same as Auth.net Direct Post method) has no way to update any configurations to stop using the md5_hash field that Auth.net will phase out. There's a possibility that this will break the transactions made from Magento to Auth.net, once Auth.net stops using md5_hash.
Auth.netIssue: Link:
My doubt is based onAt this point it's not clear what needs to be done for merchants running Magento 1.9 and using the fact"non Direct Post" Auth.net payment method. This payment method has no configuration fields that can be updated to tackle Auth.net phasing out the MD5 hash. If we don't do anything, Auth.net's response will stop sending the md5_hash which will possibly break any transactions (this is not confirmed though). If we apply the patch it's advised to configure the "Signature Key" in Magento's link they only talk about the Direct Post methodadmin, but in the link from"non Direct Post" has no "Signature Key" field.
Background:
On March 28, Auth.net they do not mentionwill deprecate the MD5 hash for their Direct Post API and their AIM API. After this date, so both mightstores that don't update their configurations won't be affected?able to process auth.net transactions, that is, all purchases using this payment method will fail. Ref Link here
So the question is: if I'm using only the AuthorizeMagento 1 offers two different Auth.net payment method,methods: Auth.net and not the AuthorizeAuth.net Direct Post method. The first one uses the AIM API, will I be affected as well?while the second uses the DPM API. Ref Link here
Update March 6:
After looking around for Magento's article about this change says that merchants that use the Direct Post method need to 1) apply a while I found this articlepatch 2) get a new "Signature Key" at Auth.net and asked3) update their Direct Post configuration with the same thingnew "Signature Key". Ref Link here
The post author clarified somethingarticle does not mention what to do for me: In Magento 2 there only exists the Auth"non Direct Post" auth.net payment method. This method's configuration does not have a "Signature Key" to set up. It does have a "Transaction Key", which is not the same as the "Signature Key" used in Direct Post. Ref Link here
Since the "non Direct Post" method uses the AIM API, while inwhich will also phase out MD5 hash, it's not clear what needs to be done for merchants using Magento 1 there are 2 payment methods: Auth.net ANDand the Auth.net "non Direct PostPost" method.
If you are on M1 and not using the Direct Post method, it seems like you won't need to apply the changeAdditional Notes (that's my case).
However, since this is pretty critical toI can confirm that in the business operation"non Direct Post" method, Auth.net's response includes an md5_hash field. I will still apply the patch and I'll be in alert modeconfirmed this by turning on the 28th, justDebug Mode in casethe "non Direct Post" method at Magento's admin. This option creates a quick action is neededlog of all the transactions with their request and response data. On every response there's a "md5_hash" field.
Update March 7:
I applied I ran the patch today butprovided by Magento in a testing instance that uses only the checkout page broke."non Direct Post" method, but I got thisan error message when loading the checkout page (not when making the actual purchase). Not sure why it's trying to parse a response from Auth.net since the purchase has not been made at this point.
Error:
Fatal error: Can't use method return value in write context in [path]../app/code/core/Mage/Authorizenet/Model/Directpost.php on line 391
Fatal error: Can't use method return value in write context in [path]../app/code/core/Mage/Authorizenet/Model/Directpost.php on line 391
Fix:
Copy/paste this file:
Givenapp/code/core/Mage/Authorizenet/Model/Directpost.php
into:
app/code/local/Mage/Authorizenet/Model/Directpost.php
At line 391 change
$hashConfigKey = !empty($response->getData('x_SHA2_Hash')) ? 'signature_key' : 'trans_md5';
with
$responseKey = $response->getData('x_SHA2_Hash');
$hashConfigKey = !empty($responseKey) ? 'signature_key' : 'trans_md5';
After this fix, the fact that we DO NOT have Direct Post enabledcheckout page loads correctly, this makes me think thatand transactions go through without problems.
Not sure how to proceed to confirm correct functionality or report additional issues. Until March 29th, we'll be monitoring the "regular"site, with special attention on the 28th, the date that Auth.net payment method will also be affected.completely phase out the MD5 hash. However if we do get a problem on that day, there's no information on what can be done.
This issueAny help is tracked inappreciated.
I discussed with the author of Magento's GH repo issuesthis article in its comments section. He thinks this auth.net change won't affect this payment method.
Esco INC's answer bellow aligns to what the author of the article above point out, it's likely the non direct post method won't be affected by this change.
