News for hackers. Stuff that matters.

A comment on Payment iframe - the easiest way to insert Stripe into your website. Parent comment

Re:Payment iframe - the easiest way to insert Stripe into yo... by bentlegen on Monday August 13, 2012 @03:49PM (#4377760)
Seems like the best solution from where I'm sitting.

Listen, if you don't trust Stripe's JavaScript, just use their HTTP API instead from your server: https://stripe.com/docs/api

[ Parent | on HN ]
Re:Payment iframe - the easiest way to insert Stripe into yo... by tptacek on Monday August 13, 2012 @03:59PM (#4377808)
You can't do that without incurring a PCI Audit, can you?

The best answer is "don't link to Javascript URLs that you don't control and audit on your website". Nobody likes that answer, but that doesn't make the second-best answer any more meaningful.

[ Parent | on HN ]
Re:Payment iframe - the easiest way to insert Stripe into yo... by cperciva on Monday August 13, 2012 @04:01PM (#4377825)
You can't do that without incurring a PCI Audit, can you?

Exactly. There's no way I would be serving up third party javascript to a logged-in Tarsnap user, even inside an iframe, if it weren't for the fact that dealing with PCI auditing would irreparably damage my sanity.

[ Parent | on HN ]