3 ms·

Thanks for the feedback, I'm definitely going to get the SSL ASAP, and just wanted to let everyone know my thought process. The way Stripe does it is actually p

Thanks for the feedback, I'm definitely going to get the SSL ASAP, and just wanted to let everyone know my thought process. The way Stripe does it is actually pretty cool. When you hit submit Javascript POSTS the card data to their servers, their servers return a token and then the form is submitted. Then in Rails I take that token and post it to Stripe and the payment is completed. It's a really interesting way to be PCI compliant without SSL.

mtogo 15y ago
Fantastic about adding the SSL. Just a note though: Without having SSL on the checkout page, i could MITM one of your users and replace that javascript on your page with my own potentially malicious javascript. Looks like a great product and the pricing is very fair. I'll remember this if i ever have a site or project i need reviewed.