>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3615524. --> Reported by: [adrianandres](https://www.drupal.org/user/2966261) Related to !61 >>> <h3 id="summary-problem-motivation">Problem/Motivation</h3> <p>Authorize.net rejects a repeat transaction that matches a recent one within a server-side "duplicate transaction window". The default window is 120 seconds. This is what protects a shopper from being charged twice when they do not see an order confirmation and submit again (slow network, page refresh, back button, double click).</p> <p>The Accept Hosted gateway does not expose this window, so the only way to tune it is per-site custom code. We have been injecting the Authorize.net <code>duplicateWindow</code> transaction setting through a custom event subscriber on individual sites, which means every site that needs a wider window has to reimplement the same fix. This belongs in contrib as a first-class gateway configuration option.</p> <h4 id="summary-steps-reproduce">Steps to reproduce</h4> <ol> <li>Configure an Authorize.net (Accept Hosted) gateway and begin a checkout.</li> <li>Complete payment but, before the order confirmation renders, resubmit the payment (refresh and submit again, use the back button, or double-submit) within a short window.</li> <li>Depending on timing, the customer can be charged twice. There is no gateway setting to widen the window beyond Authorize.net's 120 second default.</li> </ol> <h3 id="summary-proposed-resolution">Proposed resolution</h3> <p>Add an optional "Duplicate transaction window" field (in seconds) to the Accept Hosted gateway configuration form.</p> <ul> <li>When set, include the Authorize.net <code>duplicateWindow</code> setting in the transaction request that generates the hosted payment page, the same request the per-site custom subscriber currently targets.</li> <li>When empty, omit the setting so Authorize.net applies its own 120 second default (this keeps existing sites unchanged).</li> <li>Validate the value as an integer between 0 and 28800 (0 disables duplicate checking, 28800 is the 8 hour maximum).</li> </ul> <h3 id="summary-remaining-tasks">Remaining tasks</h3> <ul> <li>Add the config schema key, form field, and integer/range validation.</li> <li>Wire the value into the Accept Hosted transaction request as the <code>duplicateWindow</code> setting.</li> <li>Confirm the field label and help text.</li> <li>Manual testing (confirm checkout still works and the setting is sent; note the dedup behaviour itself is hard to exercise directly) and review.</li> </ul> <h3 id="summary-ui-changes">User interface changes</h3> <p>A new optional field on the Accept Hosted gateway configuration form:</p> <p><strong>Duplicate transaction window (seconds)</strong><br><br> How long Authorize.net should reject a repeat transaction that matches a recent one. A customer who does not see an order confirmation and submits again within this window is declined rather than charged twice. Leave empty to use the Authorize.net default of 120 seconds. Maximum 28800 (8 hours).</p> <h3 id="summary-api-changes">API changes</h3> <p>None. The change is additive gateway configuration only.</p> <h3 id="summary-data-model-changes">Data model changes</h3> <p>A new optional configuration key is added to the Accept Hosted gateway config schema. The change is additive and needs no update hook: the field defaults to empty, which preserves the current behaviour (Authorize.net's 120 second default).</p> >>> [!note] Pre-migration files - [image-1.png](https://www.drupal.org/files/issues/2026-08-07/image-1.png) - [image-2.png](https://www.drupal.org/files/issues/2026-08-07/image-2.png) >>>