Purchase the extension

a.       In the Magento Marketplace you have the option to either search for 'Cybersource Payment Management Platform' and select the extension developed by Cybersource or you can access it directly from the following link

b.       Select your Magento 'Edition' & 'Store version' i.e. 'Commerce on Cloud' and '2.4'

c.       Add your selection to cart.*

d.       Complete checkout*

Upon completion of the checkout you will be granted access keys by Magento to download these into your Magento instance pleae follow the remaining steps

*n.b. Although you're required to go through a checkout process the extension is free of charge and no card details are required to be saved within you Magento Marketplace account

Prepare you Magento Environment

After completing step 3 you can now copy your Public and Private Keys into your Magento instance:

a.       Go to My Profile -> My Products -> Access Keys

b.       Select the Cybersource extension line

c.       Copy both the Public and Private Keys

d.       In your Magento instance rename auth.json.sample file to auth.json in the Magento root directory on your server, and enter the access keys from steps above.

e.       Add the following code text to the auth.json file

            {
     "http-basic":{
        "repo.magento.com": {
            "username": "Your_Public_Key",
            "password": "Your_Private_key"
        }
    }
}
        

f.       Open composer.json and add the following keys and values under the "require" array 

            "version": "2.4.6",
         "require": {
                "goetas-webservices/xsd2php-runtime": "^0.2.15",
                "lcobucci/jwt": "4.1.5",
}

        

Download the Extension

Now that you've prepared the environment you just need to import the code base through Composer.  In order to do this run the following commands:

a.       Import the extension code

            composer require cybersource/global-payment-management
composer require cybersource/module-recaptcha

        

b.       Enable modules

            php bin/magento module:enable CyberSource_AccountUpdater CyberSource_Core CyberSource_ApplePay CyberSource_Atp CyberSource_BankTransfer CyberSource_SecureAcceptance CyberSource_ECheck CyberSource_GooglePay CyberSource_KlarnaFinancial CyberSource_VisaCheckout CyberSource_Address CyberSource_Tax CyberSource_ThreeDSecure CyberSource_PayPal CyberSource_WeChatPay CyberSource_Recaptcha
        

c.       Update, Compile and Deploy*

*n.b. Please run the below lines individually

            php bin/magento setup:di:compile
php bin/magento indexer:reindex
php bin/magento setup:upgrade
php bin/magento setup:static-content:deploy -f
php bin/magento cache:clean
php bin/magento cache:flush
php bin/magento module:status
        

You can now validate the install has been successful in two ways:

1. A Cybersource folder structure should now be visible under your 'Vendor' folder.
2. When accessing Stores -> Configuration -> Sales -> Payment Methods you will see the Cybersource configuration options

Initial Configuration

n.b. Although we have added flexible integration options, we recommend utilising our Flex Microform solution for capturing card details, this provides a full PCI-A Solution whilst offering flexibility around your chosen UI.

For in-depth guide on configuring the Extension please refer to the Extension User Guide

General Settings -> Webservice Configurations

a.         Enter you Merchant ID (Cybersource Organization ID)

b.        Test Mode -> If set to yes will point all transactions to TEST system (Please ensure you are using the correct credentials for system you're pointing to)

SOAP Settings

a.        Enter Transaction Key (Created in Step 1)

REST Settings

a.        Enter Key ID (Created in Step 1)

b.        Enter Shared Secret Key (Created in Step 1)

Credit Card Settings

a.        Set Enabled to Yes

b.        Set 'Title' to the value you would like card payments to appear under in your Store Front

c.        Select Payment API as 'SOAP Toolkit'

d.        Select Checkout Flow Mode as 'Flex Microform'

Security Best Practice Guidance

According to industry best practices, the hosting environment should enable rate limiting or implement a service like Cloudflare that will protect against these types of attacks.

As a starting point a merchant should have their environment setup with rate limits for all web applications and additional limits for the following endpoints:

• /cybersource3ds/cca/requestToken
  • Limit to 5 POST requests per session per minute
  • Limit to 20 POST requests per IP per minute for unknown networks
  • Limit to 500 POST requests per IP per minute for known networks
• /cybersource/index/loadSilentData/
  • Limit to 5 POST requests per session per minute
  • Limit to 20 POST requests per IP per minute for unknown networks
  • Limit to 500 POST requests per IP per minute for known networks
• /cybersource/index/placeorder/
  • Limit to 5 POST requests per session per minute
  • Limit to 20 POST requests per IP per minute for unknown networks
  • Limit to 500 POST requests per IP per minute for known networks 

These numbers are recommendations only and each environment should be monitored on a high and average traffic volume day to determine the actual values of the rate limit that will not affect the consumer experience.

As additional security measures, the following could be done:

• Implement captcha as an option during checkout (see Section 3.1.1 of User Guide)
• Modify the payment module to allow for session / IP rate limiting in Magento web application