A Free, Self-Hosted Back End for Stripe Checkout

#1

Post by ctcliff » Sat, Jan 24, 2015, 5:27 PM UTC

A Free, Self-Hosted Back End for Stripe Checkout
json.expert

Re: A Free, Self-Hosted Back End for Stripe Checkout

#2

Post by zrail » Sat, Jan 24, 2015, 5:55 PM UTC

Two things. First, you have a live key set up on this page, which seems like it's problematic if you're not actually providing anything. This should be a test key.

Second, I can manipulate how much I'm paying by changing the HTML. I understand that this is a very simple backend but it's also very open to manipulation. You should, at the very least, add some sort of param signing.

Re: A Free, Self-Hosted Back End for Stripe Checkout

#3

Post by ctcliff » Sun, Jan 25, 2015, 3:37 PM UTC

zrail wrote: post #2

Two things. First, you have a live key set up on this page, which seems like it's problematic if you're not actually providing anything. This should be a test key. Second, I can manipulate how much I'm paying by changing the HTML. I understand that this is a very simple backend but it's also very open to manipulation. You should, at the very least, add some sort of param signing.

This setup assumes manual order fulfillment. If someone manipulates a charge, don't deliver the goods.

If you're doing 100s of transactions per day or automating fulfillment, it would be more appropriate to invest in a full-featured back end.