2

The new integrated Vault interface for Magento 2 payment methods includes a public_hash that is generated from the payment method information:

    $hashKey = $paymentToken->getGatewayToken();
    if ($paymentToken->getCustomerId()) {
        $hashKey = $paymentToken->getCustomerId();
    }

    $hashKey .= $paymentToken->getPaymentMethodCode()
        . $paymentToken->getType()
        . $paymentToken->getTokenDetails();

However, it is unclear to me what the purpose is of this hash. It doesn't hash any information that's not also stored in clear text, and it's not the primary key of the database table.

Does anybody know why this field was added?

Improve this question

1 Answer 1

Reset to default
6

The public_hash is used to reference the card from untrusted sources (like on checkout). It gives each card a unique non-sequential identifier that can't be readily guessed, to help curb any possible abuse.

Improve this answer
2
  • What is the reason for using this instead of the entity ID of the record in the vault? If it's just an arbitrary identifier, I can't see the point. What's also strange is that it seems to be using symmetrical encryption rather than a true one-way hash, even though it's never decrypted that I can see.
    – Scott Buchanan
    Mar 22, 2017 at 3:30
  • I just reread your answer and noticed your point about it being "non-sequential." That explains why they don't just use the entity_id. Good point!
    – Scott Buchanan
    Mar 23, 2017 at 16:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.