Implementing Magento's Authorize.net DPM solution I noticed that it isn't a 'true' DPM implementation.

A true DPM implementation submits the credit card collection form directly to Authorize.net (via https://secure.authorize.net/gateway/transact.dll). The website is notified via the redirect URL that the transaction is completed then goes through the order completion process.

Magento submits the credit card information to itself, creates and submits the transaction to Authorize.net, deals with the response -- all on the Magento server.

This means that Magento 'handles' credit card information, which defeats the primary advantage of DPM -- to keep the card number off the server by directly submitting it to Authorize.net.


  • Is there a a reason Magento took this approach?
  • Isn't this approach considered less secure then submitting directly to Authorize.net?
  • Is there an extension that implements DPM they way it was intended (direct post to auth.net, close order view relay url response)
  • If not, is there a reason why there is no extension that implements DPM the way it was intended (perhaps there is no reliable way to deal with the relay URL response within Magento)

1 Answer 1


Are you sure you're looking at the right thing?

Magento 1.x implements both Authorize.Net AIM (server-based gateway) and DPM (direct-post method). The DPM gateway is true DPM, no credit card info will ever hit your server.

AIM is implemented in module Mage_Paygate, with the payment method class being Mage_Paygate_Model_Authorizenet.

DPM is implemented in module Mage_Authorizenet, with the payment method class being Mage_Authorizenet_Model_Directpost.

The code and the settings for these two methods are completely separate.

Magento 2.x implements only Direct-Post Method, no AIM.

  • Thanks for your response, Ryan. This is on Magento 1 EE. We are using the DPM method built into Magneto. The form seems to be submitting to '/checkout/onepage/savePayment' instead of directly to Auth.net 'secure.authorize.net/gateway/transact.dll'. Perhaps I am looking in the wrong place and drew the wrong conclusion? How can I easily verify that the payment form is submitting directly to auth.net?
    – mwex501
    Jul 27, 2016 at 15:04
  • Are you sure you configured, and selected, the correct method? The method code (on the payment form, and in the params sent to Magento) should be authorizenet_directpost, as opposed to authorizenet.
    – Ryan Hoerr
    Jul 27, 2016 at 15:12
  • Confirming"authorizenet_directpost" FYI: When the checkout is completed, the following items are presented in the network tab of developer tools (don't know if this helps): f3i3yX1bUNG61Yka/ blank.html transact.dll f3i3yX1bUNG61Yka/
    – mwex501
    Jul 27, 2016 at 15:36
  • Looking deeper into what happens when the one page checkout is submitted with DPM, it looks like several AJAX calls are made, several to the Magneto server itself, one to authorize.net. Can we somehow confirm that no card number is being sent to Magento and only to authorize.net?
    – mwex501
    Jul 27, 2016 at 15:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.