3 ms·
By including their JS, you give them full access to all of the contents of your payment page and depending on how you have configured your session cookie or dep
by pilif 14y ago
By including their JS, you give them full access to all of the contents of your payment page and depending on how you have configured your session cookie or depending on the browser, full access to the users session. Now in general, you can probably trust them, but what if they are compromised?
By using an iframe you make sure that they do not get access to any information on your page - much less the users session cookie.
- JSadowski 14y agoAnd you can accomplish the same thing by using an iframe that you have full control over. Instead, if you use this service, you're trusting another 3rd party site to be available and to not be compromised.
- tptacek 14y agoThat is true, but the point is that the only thing that is going to be compromised is the data that would be going to Stripe. I know it is shocking to many of you to hear this, but the data Stripe collects is not really the most sensitive information on the Internet. The point of the iframe is to contain the damage from any possible compromise. If PAYMENTIFRAME.COM is insecure (heh), you still aren't going to lose user sessions to your actual application.
- JSadowski 14y agoNo, just potentially their credit card information.