Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Payment iframe - the easiest way to insert Stripe into your website

paymentiframe.com

Post reply on HN
Print view View original

1–10 of 84 posts

Re: Payment iframe - the easiest way to insert Stripe into your website

#3

Post by TomGullen »

> one of the basic principles of security is to avoid trusting people unnecessarily

And asking customers to enter their CC details on your domain doesn't break this rule?

> a form will be submitted to your server with a stripe_token for you to process

I'm assuming it just sends the Stripe token, and not CC info? If it does send CC info, I assume it's compliant with all the laws and regulations in every country?

Re: Payment iframe - the easiest way to insert Stripe into your website

#4

Post by xyzzyb »

benblodgett wrote: post #2

Stripe is meant for developers, and it is quite easy to integrate using their javascript api. If you can code a form you write basic javascript you can integrate stripe.

Exactly. Stripe is probably one of the easiest integrations I've ever done.

In fact, their tutorials are so well written and their signup so frictionless that I'd say that any interested website creator should have little trouble setting up a form actually using stripe instead of an iframe.

Re: Payment iframe - the easiest way to insert Stripe into your website

#5

Post by cperciva »

TomGullen wrote: post #3

> one of the basic principles of security is to avoid trusting people unnecessarily And asking customers to enter their CC details on your domain doesn't break this rule? > a form will be submitted to your server with a stripe_token for you to process I'm assuming it just sends the Stripe token, and not CC info? If it does send CC info, I assume it's compliant with all the laws and regulations in every country?

asking customers to enter their CC details on your page doesn't break this rule?

It doesn't break that rule for me. It is a reason why other Stripe users might want to think twice before using the iframe I host, of course.

I'm assuming it just sends the Stripe token, and not CC info?

Yes.

Re: Payment iframe - the easiest way to insert Stripe into your website

#6

Post by pilif »

benblodgett wrote: post #2

Stripe is meant for developers, and it is quite easy to integrate using their javascript api. If you can code a form you write basic javascript you can integrate stripe.

By including their JS, you give them full access to all of the contents of your payment page and depending on how you have configured your session cookie or depending on the browser, full access to the users session. Now in general, you can probably trust them, but what if they are compromised?

By using an iframe you make sure that they do not get access to any information on your page - much less the users session cookie.

Re: Payment iframe - the easiest way to insert Stripe into your website

#7

Post by cperciva »

benblodgett wrote: post #2

Stripe is meant for developers, and it is quite easy to integrate using their javascript api. If you can code a form you write basic javascript you can integrate stripe.

I've been hanging out in the Stripe Campfire chat for the past week. There's a rather scary number of people who need something like this.

Re: Payment iframe - the easiest way to insert Stripe into your website

#8

Post by JSadowski »

pilif wrote: post #6
benblodgett wrote: post #2

Stripe is meant for developers, and it is quite easy to integrate using their javascript api. If you can code a form you write basic javascript you can integrate stripe.

By including their JS, you give them full access to all of the contents of your payment page and depending on how you have configured your session cookie or depending on the browser, full access to the users session. Now in general, you can probably trust them, but what if they are compromised? By using an iframe you make sure that they do not get access to any information on your page - much less the users session c…

And you can accomplish the same thing by using an iframe that you have full control over.

Instead, if you use this service, you're trusting another 3rd party site to be available and to not be compromised.

Post reply on HN