5 ms·
Wow looks nice. Is an SSL certificate still required since the JS is on Stripe's secure server?
by terrellm 14y ago
Wow looks nice. Is an SSL certificate still required since the JS is on Stripe's secure server?
- latortuga 14y agoYes, absolutely 100% yes an SSL certificate is still required. Look up mixed content warnings and why they're a bad thing.
- ceejayoz 14y agoYou get a mixed-content warning for HTTP on HTTPS, but not HTTPS on HTTP as you're already insecure on the original page anyways.
- jackowayed 14y agoYes. Otherwise an attacker could serve a page that looks just like your page, but has different javascript that ships them the credit card numbers. If you're not using SSL, you should just assume that an attacker can break your page in every conceivable way.
- durkie 14y agofwiw -- my site is hosted with a company that doesn't have ssl, and we just direct our payments over to a heroku page, which is served by ssl on their free plan.