4 ms·
data-amount="2000" It looks nice but every payment solution where the client can arbitrarily change the amount they're going to pay is inherently flawed.
by melvinmt 14y ago
data-amount="2000"
It looks nice but every payment solution where the client can arbitrarily change the amount they're going to pay is inherently flawed.
- pc 14y agoThe amount is just for display purposes. You then charge whatever amount you want on the server.
- prezjordan 14y agoCould you deliberately deceive the user then? Put say, amount=500 and actually charge $20?
- pc 14y agoSure -- but you can always deceive the user.
- prezjordan 14y agoI guess my real question is - is there another page where it securely says the actual amount? (Does that make any sense?)
- nodesocket 14y agoThe amount is charged server-side, no way.
- deleted 14y ago[deleted]
- deleted 14y ago[deleted]
- dasil003 14y agoYou should take a closer look at Stripe before jumping to such conclusions. It's hands down one of the smartest, cleanest and best-documented APIs in the history of the Internet. They would not make a glaring mistake like this (though their users easily could).
- dasil003 14y agoIs this what HN has come to now? People jumping to ill-informed conclusions simply for the sake of triumphantly finding an ostensible flaw are voted higher than people who know what they're talking about?