Implementing Magento's Authorize.net DPM solution I noticed that it isn't a 'true' DPM implementation.
A true DPM implementation submits the credit card collection form directly to Authorize.net (via https://secure.authorize.net/gateway/transact.dll). The website is notified via the redirect URL that the transaction is completed then goes through the order completion process.
Magento submits the credit card information to itself, creates and submits the transaction to Authorize.net, deals with the response -- all on the Magento server.
This means that Magento 'handles' credit card information, which defeats the primary advantage of DPM -- to keep the card number off the server by directly submitting it to Authorize.net.
- Is there a a reason Magento took this approach?
- Isn't this approach considered less secure then submitting directly to Authorize.net?
- Is there an extension that implements DPM they way it was intended (direct post to auth.net, close order view relay url response)
- If not, is there a reason why there is no extension that implements DPM the way it was intended (perhaps there is no reliable way to deal with the relay URL response within Magento)