Forums / Built-in Shipping and Payment Modules / Security warning on return from Authorize.net

Security warning on return from Authorize.net

Started by claynomi on 11 Jan 2012, 3:51 PM · Views: 1,300

Results 1 to 2 of 2
11 Jan 2012, 3:51 PM
#1
claynomi avatar

claynomi

New Zenner

Join Date:
Aug 2009
Posts:
7
Plugin Contributions:
0

Security warning on return from Authorize.net

I'm using Authorize.net to process payments. Customers leave my site (which does not have SSL) and go to authorize.net to process the payment. After submitting the payment, and on the screen that says "This page will automatically redirect you back to ...com for your order confirmation details. If you are not redirected within 5 seconds...", a security warning box pops up that says "Although this page is encrypted, the information you have entered is to be sent over an unencrypted connection and could easily be read by a third party. Are you sure you want to continue sending this information?"

I'm assuming that this happens because authorize.net is sending the customer information VIA a hidden form from their SSL site to the non-SSL store for processing.

  1. Is that correct? and,
  2. Is there anything that can be done to eliminate this message other than get SSL on the store site?

Thanks

11 Jan 2012, 4:01 PM
#2
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,511
Plugin Contributions:
176

Re: Security warning on return from Authorize.net

You will need to get SSL on the store site. It's very inexpensive these days, and gives your customers the added peace of mind that you actually take security seriously.

.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole

Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.