Magento using Authorize.net DPM

Question

Implementing Magento's Authorize.net DPM solution I noticed that it isn't a 'true' DPM implementation.

A true DPM implementation submits the credit card collection form directly to Authorize.net (via https://secure.authorize.net/gateway/transact.dll). The website is notified via the redirect URL that the transaction is completed then goes through the order completion process.

Magento submits the credit card information to itself, creates and submits the transaction to Authorize.net, deals with the response -- all on the Magento server.

This means that Magento 'handles' credit card information, which defeats the primary advantage of DPM -- to keep the card number off the server by directly submitting it to Authorize.net.

MY QUESTIONS:

• Is there a a reason Magento took this approach?
• Isn't this approach considered less secure then submitting directly to Authorize.net?
• Is there an extension that implements DPM they way it was intended (direct post to auth.net, close order view relay url response)
• If not, is there a reason why there is no extension that implements DPM the way it was intended (perhaps there is no reliable way to deal with the relay URL response within Magento)

Answer 1

Are you sure you're looking at the right thing?

Magento 1.x implements both Authorize.Net AIM (server-based gateway) and DPM (direct-post method). The DPM gateway is true DPM, no credit card info will ever hit your server.

AIM is implemented in module Mage_Paygate, with the payment method class being Mage_Paygate_Model_Authorizenet.

DPM is implemented in module Mage_Authorizenet, with the payment method class being Mage_Authorizenet_Model_Directpost.

The code and the settings for these two methods are completely separate.

Magento 2.x implements only Direct-Post Method, no AIM.