FREQUENTLY ASKED QUESTIONS

Transcription

1 Last Updated on November 25, 2013 FREQUENTLY ASKED QUESTIONS This documentation will be updated frequently. Please check back often for the most recent information. MIGRATION REQUIREMENTS /TIMELINES Do I have to migrate? We are decommissioning our current HOP and SOP implementations by Sept To avoid any disruption in the processing of your transactions, CyberSource recommends that you begin the migration process as soon as possible. How do we determine if we need to migrate? Merchants currently using the Hosted Order Page (HOP) or Silent Order Post (SOP) are required to migrate to Secure Acceptance prior to September To confirm if you are processing transactions with HOP/SOP we advise logging in to the Enterprise Business Center ( and running a General Search (Transaction Search > General Search) for the latest transactions. Drill down to the transaction by clicking on the Request ID to get the details of the transaction and check which Client Application is being used. When is Secure Acceptance going to be live? Can we migrate now? Secure Acceptance is available now in both test and production environments. Merchants can begin migrating today. What is the level of effort required? The level of effort will vary by merchant depending on the complexity of their HOP/SOP implementation. Merchants will require some technical skills such as being able to read and modify web pages and code. We have multiple integrations (with key file, HOP). Will I need to migrate both? No. You will only need to migrate your HOP implementations. You integrations using the API are not impacted. Does this impact the SOAPI implementations? Is the migration to the Secure Acceptance going to have any impact on the SOAP Toolkit API? Only your existing HOP and/or SOP implementations will be impacted. This migration does not apply to SOAP or SOAPI. Page 1

2 Will this impact all my distributors? Yes. If they are selling solutions that are based on the legacy HOP and SOP, they will need to upgrade prior to September TESTING PROCESS Can we set up Secure Acceptance Web/Mobile on the test EBC and begin testing while still running HOP in production? Yes. Our test and production environments are independent of each other. Merchants have the ability to test Secure Acceptance Web/Mobile in our test environment without impact to HOP transactions in production. How can we set up Secure Acceptance in test mode? As an existing Cybersource merchant you have access to our test environment to configure and test Secure Acceptance. Testing may be done in parallel with HOP production transactions. See the Full Configuration Guide for full details: Is it preferable to create a test account or use the test side of the existing account? Either option is acceptable for testing. Note - in production you will need to recreate the Secure Acceptance profile(s). Is the functionality of the test url similar to that of the old HOP/SOP url? Yes. The test endpoints for Secure Acceptance routes transactions to the test environment. How many fields need to be signed to generate a signature? There are eleven required fields that must be included in the signed_fields parameter to generate the signature. These eleven fields are identified in the documentation in the section Required API Request Fields in Chapter 9. CyberSource recommends including as many request fields in the signed_fields parameter as possible to prevent data tampering. The card_number field should never be included as one of the signed_fields. The remaining fields that are not part of creating the signature need to be included in the unsigned fields parameter. Any field that is not listed in either the signed_fields or unsigned_fields parameters will be ignored when the data is sent to the Secure Acceptance endpoint. Page 2

3 MIGRATION TOOLS Is there an outline of the minimum requirements to migrate? We are continually adding material to the Secure Acceptance Resource Center located at to assist merchants with the migration. For starters, check out the Secure Acceptance Migration Quick Start Guide that will detail steps on how to quickly get up and running with Secure Acceptance. SECURE ACCEPTANCE & PAYMENT TOKENS Will all of the old payment tokenization ID numbers still be valid? Yes. Payment tokenization IDs used with HOP/SOP will continue to work with Secure Acceptance. Are payment tokens specific to profiles? No. Payment tokens maybe used across multiple Secure Acceptance profiles. SECURE ACCEPTANCE & SUBSCRIPTIONS/RECURRING PAYMENTS Will the migration have any impact on recurring charges/subscriptions that are established within Hosted Order Pages yet carry beyond October 2014? Will subscriptions created on the Hosted Order Page migrate over to Secure Acceptance automatically? Recurring billing subscriptions that were created using the legacy HOP will continue to work. Will existing subscription tokens work with the new Secure Acceptance? Yes. Existing subscription tokens will continue to work with Secure Acceptance. Is it possible to create a subscription using Secure Acceptance Web/Mobile? Yes. Secure Acceptance supports the creation of recurring, installment, or ondemand/standalone payment tokens. Details are provided in the Full Configuration Guide found on the Secure Acceptance Migration Resource Center: Page 3

4 USING PROFILES IN SECURE ACCEPTANCE Can we re-use our existing legacy HOP profile? No. Merchants will need to configure new Secure Acceptance profile(s) independent of previous HOP settings. Can you have different profiles for different card types? Yes. Secure Acceptance profiles allow merchants to select card types to offer as payment methods. For each card type you can also manage currencies, CVN and payer authentication options. The profile creation page has "profile ID" as a required field. Is that something we should create? Yes, this field is required. It is used in each transaction to identify and display the Secure Acceptance profile. The profile ID is case sensitive and must be exactly 7 alphanumeric characters. What is the maximum number of Secure Acceptance Web/Mobile profiles that can be created for a given Merchant ID (MID)? There is no limitation on the number of profiles for a particular MID. GENERAL Does Secure Acceptance still keep all the transaction data on your network? Yes. Although Secure Acceptance replaces our HOP and SOP, the purpose of the solution is still to help merchants reduce PCI scope by avoiding the need for PAN data to traverse the merchant s network. With Secure Acceptance, just like the HOP and SOP, payment data is directly posted to a CyberSource endpoint. Are iframes or popup windows supported in the web/mobile feature? iframes or popup windows using Secure Acceptance Web/Mobile are not supported by most browsers used today like IE and Safari. This is mainly due to session management and how browsers currently handle cookies. The legacy HOP passed the sesssionid as a URL parameter. There are potential security vulnerabilities using this approach namely session fixation or hijacking. Secure Acceptance, on the other hand, uses a more secure method to handle sessions by storing the ID in a cookie. Unfortunately, the security protocols in the browsers view this cookie as a third party cookie. When the user goes from the main page to the popup or iframe, the browser prevents the cookie from being created, thus a session timeout occurs. iframes Page 4

5 currently work using a SOP implementation. We are looking at solutions to have iframe support with Web/Mobile. How will this effect customers using Cybersource with a shopping cart or third party software/? We have proactively contacted partners with pre-built integrations to CyberSource using the legacy HOP/SOP connections and informed them of the Secure Acceptance migration. We recommend that you contact the vendors involved in your payment flows to ensure they are aware of the migration and are planning for the development effort. Will there be a module for Drupal Commerce? Yes. Please refer to Drupal.org for news and notes regarding CyberSource SA integration with Drupal Commerce. Are there resources for ASP.NET and hosted server solutions (e.g. cannot register COM components/dlls. There is sample ASP.Net code available in the documentation. Secure Acceptance does not require registering any com components or dlls beyond what should already be installed on your server. Will Secure Acceptance Web/Mobile support ColdFusion as an option? Secure Acceptance supports any dynamic scripting language that can generate a SHA256 signature. The supported languages that CyberSource officially supports are listed in the guide. Does Secure Acceptance work in a 64-bit Windows 2008 Server environment? Yes. Secure Acceptance does not require any installation of dlls beyond what is standard for your web server. Secure Acceptance can support any dynamic scripting language that supports HMAC256 hashing algorithms. In our documentation, there are samples the demonstrate how to implement Secure Acceptance. Each sample consists of a security script, a payment form, a payment confirmation page, and a receipt page. Does Secure Acceptance support notifications to credit card customers? Yes. Secure Acceptance supports both merchant notifications and customer notifications. Our app is coded in Python and we had to build our own Python version of the HOP script. Is there any sample Python code? Although we do not officially provide support for Python, Secure Acceptance can be used with any dynamic scripting language that supports HMAC256 hashing algorithms. Page 5