2 ms·
The difference is if you make the user click a link to Stripe's site then unless the evil JS replaces the URL with a different domain they can no longer interac
by 3pt14159 10y ago
The difference is if you make the user click a link to Stripe's site then unless the evil JS replaces the URL with a different domain they can no longer interact with the user. And swapping out links is something that will get noticed far more easily than passively harvesting CC details.
- the_mitsuhiko 10y agoStripe does not use an iframe/redirect for protection.
- zrail 10y agoStripe Checkout is loaded in an iframe and stripe.js uses an iframe for data transmission.
- the_mitsuhiko 10y agoI know, but the credit card information for stripe.js lives in an unprotected DOM.
- collinmanderson 10y agoRight. It's sort of a loop hole where they technically use an iframe for PCI compliance, but they don't actually get any security benefit from it.
- andybak 10y agoThat's not usually how Stripe integration works, is it?