3 ms·

Stripe does not use an iframe/redirect for protection.

• zrail 10y ago
  Stripe Checkout is loaded in an iframe and stripe.js uses an iframe for data transmission.
  • the_mitsuhiko 10y ago
    I know, but the credit card information for stripe.js lives in an unprotected DOM.
    • collinmanderson 10y ago
      Right. It's sort of a loop hole where they technically use an iframe for PCI compliance, but they don't actually get any security benefit from it.