3 ms·
Since the page is loaded over plaintext, there's no easy way for a normal user to know that the credit card isn't being intercepted by a malicious script. It's
by Titanous 12y ago
Since the page is loaded over plaintext, there's no easy way for a normal user to know that the credit card isn't being intercepted by a malicious script. It's not safe to serve a payment page over plaintext HTTP, even if it POSTs to a HTTPS endpoint as it could be modified in transit.
Stripe explains that TLS is required in their docs: https://stripe.com/help/ssl https://stripe.com/help/ssl
- imron 12y agoIf you read a bit further, the Stripe documentation explains that it is recommended, but not required. You can make live transactions just fine from a regular HTTP page - whether that's a good idea or not is another issue, but making Stripe payments from an HTTPS payment page is not required from an API point of view.
- Titanous 12y agoThey explain use cases for testing without HTTPS, but make it clear that TLS is required for production use.
- imron 12y agoRequired in the 'it's a good idea because it will make the web more secure and make your customers trust you' sense, not required in the sense that it's something the API enforces.