3 ms·
Is it really a good idea to be making HTTP requests with the card number and CVC in the URL? I get that it's over HTTPS, so the whole thing is encrypted, but w
by joosters 13y ago
Is it really a good idea to be making HTTP requests with the card number and CVC in the URL?
I get that it's over HTTPS, so the whole thing is encrypted, but won't the URL still be saved in my browser history, which will end up on disk and be available to anyone who gets on to my computer?
If the request was a POST method instead, you'd avoid these possible weaknesses. Or am I missing something?
- mmcnickle 13y agoFrom the article: > Stripe POSTs at a /tokens API endpoint over https, which means everything is encrypted including the query params
- joosters 13y agoIt's still a little unclear: It says that it is a POST, but the URL in the box above contains the card details. Further, the bit of text you quote goes on to say: > ...including the query params. These params include the card number, expiration date, and CVC The URL they give as an example is: https://api.stripe.com/v1/tokens?email=foo%40example.com&payment_user_agent=Stripe+Checkout&amount=0&iovation_blackbox=a_very_large_string>&card[number]=4242+4242+4242+4242&card[cvc]=123 https://api.stripe.com/v1/tokens?email=foo%40example.com&pay... &card[exp_month]=4&card[exp_year]=2014&card[name]=foo%40example.com&key=pk_test_6pRNASCoBOKtIshFeQd4XMUh&callback=sjsonp1390180955159&_method=POST So are these params in the URL, or not?