3 ms·
If I remember how they worked (last did stripe integration a ways back), the script instruments your form's submit event to do an (ajax if possible) POST to str
by ryebit 9y ago
If I remember how they worked (last did stripe integration a ways back), the script instruments your form's submit event to do an (ajax if possible) POST to stripe's server, which processes everything, and returns back a (merchant specific) "token" representing a redeemable charge to the customer. The form is then posted to your server, but all it gets is the "token", which it can then use your private merchant key to redeem behind the scenes with their server.
So you get an anonymous "charge" token that you can revoke if a later part of the checkout process fails, and CC data never touches your system.
(I think the markup for that was a little bit different than what was posted above though).
- gnaritas 9y agoCorrect, and the big reason for that is it means you don't have to be PCI compliant since the card never touches your server, only stripes. That's why Stripe blew up, Paypal had no such offering for allowing you to use your own checkout form but not have to pass the card through your server.
- surfmike 9y agoNot true, PayPal Payments Pro offered that.
- Kluny 9y agoThat product seems to have a marketing problem. I've heard plenty of PayPal horror stories over the years, but this thread is the first time I've ever heard of Payments Pro.
- gnaritas 9y agoNot exactly, the Paypal transparent redirect one still bounces you through paypal's URL; the Stripe one never leaves your domain.