Cybersource SOAP: Update authentication using p12 keys #5415

sinourain · 2025-02-25T21:39:09Z

Summary

This changes include the Cybersource p12 authentication. Extract the public_key and private_key from the p12 file provided/generated in the Cybersource dashboard.

fixtures.yml

cyber_source_certificate:
  login: merchant_id,
  public_key: SOMECREDENTIAL,
  private_key: SOMECREDENTIAL

Spreedly reference

OPPS-348

Tests

Unit Tests

Finished in 33.396675 seconds.
6218 tests, 81341 assertions, 0 failures, 0 errors, 0 pendings, 0 omissions, 0 notifications
100% passed
186.19 tests/s, 2435.60 assertions/s

Remote Tests

Finished in 176.54427 seconds.
148 tests, 762 assertions, 3 failures, 0 errors, 0 pendings, 0 omissions, 0 notifications
97.973% passed
0.84 tests/s, 4.32 assertions/s

Rubocop

808 files inspected, no offenses detected

Heavyblade

Comment, Nice job @sinourain this was a hard one, left some comments for your consideration.

Heavyblade · 2025-03-10T16:28:41Z

lib/active_merchant/billing/gateways/cyber_source.rb

@@ -43,6 +45,18 @@ class CyberSourceGateway < Gateway
      }
      DEFAULT_COLLECTION_INDICATOR = 2

+      NS_DS = 'http://www.w3.org/2000/09/xmldsig#'


💬 Comment:

The first thing to say is that maybe all these signature code perhaps should live in a separate module, There is too much code to throw directly into the main adapter.

That's what I thought, but then I saw the cybersource rest code, which by the way is similar (made by you), so I decided to leave it here, in the end it was much simpler.

Mmmm yes and no @sinourain , Yes CybersourceRest has the signature there, but is a ~15 lines method and that's it, here we have a ton of functionality not directly related to the main purpose of the adapter.

Is a judgment call at the end, but it looks bloated to me.

I agree on this, it would be nice if those lived in another place. But again it's not code breaking and it works

Heavyblade · 2025-03-10T16:32:36Z

lib/active_merchant/billing/gateways/cyber_source.rb

+      def signature_element(xml, body)
+        signed_info = sign_info(body)
+        rsa_private_key = OpenSSL::PKey::RSA.new(@options[:private_key])
+        signature = rsa_private_key.sign(OpenSSL::Digest.new('SHA256'), canonicalization(signed_info))


💬 Comment:

if you do the canonicalization first then you could just past that value to the sing_info method and with that just call the canonicalization method only once.

Heavyblade · 2025-03-10T16:36:04Z

lib/active_merchant/billing/gateways/cyber_source.rb

+      end
+
+      # Where we actually build the full SOAP request using builder
+      def build_request(request, options)


💬 Comment - ❓ Question:

Are you sure is a good idea to rewrite the entire build_request method ?, is going to be end-up being used for the two authentication methods.

I need the information from the request and in order not to repeat requesting this twice I decided to modify it just a little, I tested it with both forms of authentication and it works well.

Heavyblade · 2025-03-10T16:40:48Z

lib/active_merchant/billing/gateways/cyber_source.rb

+      def build_request(request, options)
+        xsd_version = test? ? TEST_XSD_VERSION : PRODUCTION_XSD_VERSION
+
+        body = set_body(request, options, xsd_version)


💬 Comment:

set_body isn't actually "setting" body on anything, the method is more "building" a body than "setting" a body.

💬 Style / Suggestion:

What about re-organizing the code so it has a more logical order like this:

def build_request(request, options) xsd_version = test? ? TEST_XSD_VERSION : PRODUCTION_XSD_VERSION xml = Builder::XmlMarkup.new indent: 2 xml.instruct! xml.tag! 's:Envelope', { 'xmlns:s' => ENVELOPE, 'xmlns' => "urn:schemas-cybersource-com:transaction-data-#{xsd_version}" } do set_headers(xml, body) xml << build_body(request, options, xsd_version) end xml.target! end

If I remove the body assignation I get an error in the set_headers call, so I prefer the current code

Heavyblade · 2025-03-10T16:54:34Z

test/unit/gateways/cyber_source_test.rb

+    end.check_request do |_endpoint, data, _headers|
+      assert_match(/<ccAuthService run="true"\/>/, data)
+    end.respond_with(successful_authorization_certificate_response)
+  end


💬 Comment:

This test isn't asserting any behavior related to your change, it is just asserting a tag that was already there

Heavyblade · 2025-03-10T16:57:52Z

test/unit/gateways/cyber_source_test.rb

+    end.respond_with(successful_authorization_certificate_response)
+  end
+
+  def test_successful_certificate_purchase


💬 Comment;

Same case here and the next test

Heavyblade · 2025-03-10T17:00:09Z

test/unit/gateways/cyber_source_test.rb

+    end.respond_with(successful_verify_certificate_response)
+    assert_success response
+  end
+


💬 Comment:

There is a lack of coverage for all the code written to generate the signature sign_info, signature_element, set_headers, set_bodyand canonicalization doesn't have any related tests.

almalee24

Make sure you're scrubbing public_key and private_key in the scrub method

sinourain · 2025-03-12T15:04:37Z

Make sure you're scrubbing public_key and private_key in the scrub method

I added the public_key that was being exposed to the scrub method, the private_key is not exposed so it is not necessary to add it

almalee24 · 2025-03-12T20:05:37Z

lib/active_merchant/billing/gateways/cyber_source.rb

+
+        xml.tag! 'ds:Signature', { 'xmlns:ds' => NS_DS } do
+          xml << signed_info
+          xml.tag! 'ds:SignatureValue', { 'xmlns:ds' => NS_DS } do


Is it possible for someone to extract the private key from here?

No, it is not possible to extract the private key from the signature. The private key is used to generate the signature, but the signature itself does not contain the private key. The signature is a cryptographic hash that can be verified using the corresponding public key, but it cannot be reversed to obtain the private key. However, it is possible to add the digest value and signature to the scrub method to prevent any information in the transcript from being exposed.

If it won't expose any sensitive info I think it's fine. I will approve but can you just get double confirmation from Cybersource on this?

Sure! While we wait for confirmation from Cybersource, I added the digest value and the signature to the scrub method.

almalee24 · 2025-03-12T21:41:24Z

lib/active_merchant/billing/gateways/cyber_source.rb

-        requires!(options, :login, :password)
+        if options[:public_key]
+          options[:merchant_id] ||= options[:login]
+          requires!(options, :merchant_id, :public_key, :private_key)


Is there a reason you decided to change it from login to merchant_id?

Only that merchant_id is more descriptive to the value it corresponds to, however, I'm going to remove it to only have login

…public_key and private_key from the p12 file provided/generated in the Cybersource dashboard. fixtures.yml ``` cyber_source_cypher: merchant_id: merchant_id, public_key: SOMECREDENTIAL, private_key: SOMECREDENTIAL ``` (OPPS-348)[https://spreedly.atlassian.net/browse/OPPS-348] Finished in 33.396675 seconds. 6218 tests, 81341 assertions, 0 failures, 0 errors, 0 pendings, 0 omissions, 0 notifications 100% passed 186.19 tests/s, 2435.60 assertions/s Finished in 176.54427 seconds. 149 tests, 762 assertions, 3 failures, 0 errors, 0 pendings, 0 omissions, 0 notifications 97.973% passed 0.84 tests/s, 4.32 assertions/s 808 files inspected, no offenses detected

klumsy · 2025-03-13T21:51:10Z

What is the regression risk of such a large refactor , is it going to be feature flagged before landing?

sinourain · 2025-03-13T22:35:20Z

What is the regression risk of such a large refactor, is it going to be feature flagged before landing?

Yes, these changes are for when the merchant adds the certificates (private and public keys), if they do not add them, they would use the current code (login/password) and it will continue to work the same as now.

sinourain force-pushed the OPPS-348_cybs_p12 branch 2 times, most recently from 7756c0d to 40f1900 Compare March 8, 2025 04:08

sinourain changed the title ~~WIP: Cybersource SOAP: Update authentication using p12 keys~~ Cybersource SOAP: Update authentication using p12 keys Mar 8, 2025

sinourain marked this pull request as ready for review March 8, 2025 04:10

sinourain requested a review from a team March 8, 2025 15:07

sinourain force-pushed the OPPS-348_cybs_p12 branch from 40f1900 to 8659932 Compare March 8, 2025 23:08

Heavyblade reviewed Mar 10, 2025

View reviewed changes

sinourain force-pushed the OPPS-348_cybs_p12 branch 2 times, most recently from add6527 to 177b892 Compare March 10, 2025 21:15

almalee24 requested changes Mar 11, 2025

View reviewed changes

sinourain force-pushed the OPPS-348_cybs_p12 branch from 177b892 to 6db85a9 Compare March 12, 2025 15:01

sinourain requested a review from almalee24 March 12, 2025 15:04

almalee24 reviewed Mar 12, 2025

View reviewed changes

sinourain force-pushed the OPPS-348_cybs_p12 branch 2 times, most recently from 51f4bca to 95fa6fe Compare March 13, 2025 12:45

sinourain force-pushed the OPPS-348_cybs_p12 branch from 95fa6fe to 95006fb Compare March 13, 2025 12:47

almalee24 approved these changes Mar 13, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Cybersource SOAP: Update authentication using p12 keys #5415

Cybersource SOAP: Update authentication using p12 keys #5415

sinourain commented Feb 25, 2025 •

edited

Loading

Heavyblade left a comment

Heavyblade Mar 10, 2025

sinourain Mar 10, 2025

Heavyblade Mar 12, 2025

almalee24 Mar 12, 2025 •

edited

Loading

Heavyblade Mar 10, 2025

sinourain Mar 10, 2025

Heavyblade Mar 10, 2025

sinourain Mar 10, 2025

Heavyblade Mar 10, 2025

Heavyblade Mar 10, 2025

sinourain Mar 10, 2025

Heavyblade Mar 10, 2025

sinourain Mar 10, 2025

Heavyblade Mar 10, 2025

sinourain Mar 10, 2025

Heavyblade Mar 10, 2025

sinourain Mar 10, 2025

almalee24 left a comment

sinourain commented Mar 12, 2025

almalee24 Mar 12, 2025

sinourain Mar 12, 2025

almalee24 Mar 12, 2025

sinourain Mar 13, 2025

almalee24 Mar 12, 2025

sinourain Mar 13, 2025

klumsy commented Mar 13, 2025

sinourain commented Mar 13, 2025

Cybersource SOAP: Update authentication using p12 keys #5415

Are you sure you want to change the base?

Cybersource SOAP: Update authentication using p12 keys #5415

Conversation

sinourain commented Feb 25, 2025 • edited Loading

Summary

Spreedly reference

Tests

Unit Tests

Remote Tests

Rubocop

Heavyblade left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

almalee24 Mar 12, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

almalee24 left a comment

Choose a reason for hiding this comment

sinourain commented Mar 12, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

klumsy commented Mar 13, 2025

sinourain commented Mar 13, 2025

sinourain commented Feb 25, 2025 •

edited

Loading

almalee24 Mar 12, 2025 •

edited

Loading