Payment iframe - the easiest way to insert Stripe into your website

http://www.paymentiframe.com/

by cperciva • 14 years ago

68 81 14 years ago

Stripe is meant for developers, and it is quite easy to integrate using their javascript api. If you can code a form you write basic javascript you can integrate stripe.

xyzzyb• 14 years ago

Exactly. Stripe is probably one of the easiest integrations I've ever done.

In fact, their tutorials are so well written and their signup so frictionless that I'd say that any interested website creator should have little trouble setting up a form actually using stripe instead of an iframe.

infinite8s• 14 years ago

The whole point of the iframe is that it prevents the code from inside the iframe (ie the payment handling code that sends data to stripe) from having access to the parent page's data. Sometimes the CC info isn't the most sensitive info a user has given that website (particularly for a service that manages your online backups).

pilif• 14 years ago

By including their JS, you give them full access to all of the contents of your payment page and depending on how you have configured your session cookie or depending on the browser, full access to the users session. Now in general, you can probably trust them, but what if they are compromised?

By using an iframe you make sure that they do not get access to any information on your page - much less the users session cookie.

JSadowski3• 14 years ago

And you can accomplish the same thing by using an iframe that you have full control over.

Instead, if you use this service, you're trusting another 3rd party site to be available and to not be compromised.

cperciva22• 14 years ago

I've been hanging out in the Stripe Campfire chat for the past week. There's a rather scary number of people who need something like this.

TomGullen3• 14 years ago

> one of the basic principles of security is to avoid trusting people unnecessarily

And asking customers to enter their CC details on your domain doesn't break this rule?

> a form will be submitted to your server with a stripe_token for you to process

I'm assuming it just sends the Stripe token, and not CC info? If it does send CC info, I assume it's compliant with all the laws and regulations in every country?

cperciva22• 14 years ago

asking customers to enter their CC details on your page doesn't break this rule?

It doesn't break that rule for me. It is a reason why other Stripe users might want to think twice before using the iframe I host, of course.

I'm assuming it just sends the Stripe token, and not CC info?

Yes.

TomGullen3• 14 years ago

> It is a reason why other Stripe users might want to think twice before using the iframe I host, of course.

Well that's the point really. You say that a "basic principle of security" is to "avoid trusting people unnecessarily" which is exactly what this service you have created is asking people to do.

suweekly• 14 years ago

Or use authorize.net's iframe module and save a ton of $ on Stripe's ripoff fees.

Zr40• 14 years ago

http://www.authorize.net/files/cybersource_pricing.pdf

Ignoring all those extra fees and charges unrelated to a single payment, Authorize.net charges 2.19% + $0.27 in the best case (qualified domestic Visa). In the worst case (non-qualified international MasterCard), they charge 4.49% + $0.2685.

Even only considering the best case, Stripe's 2.9% + $0.30 doesn't seem 'ripoff' to me.

majke• 14 years ago

Iframes can leak key presses to an evil parent frame:

https://www.owasp.org/index.php/Cross_Frame_Scripting

> Every key press the browser user makes in the example.com frame, while trying to log into example.com, can be captured by the attacker, and reported back to evil.com.

But this is irrelevant - user can't verify if the domain of the iframe is trusted. If the attacker can modify the parent frame javascript he can just replace the iframe with a phishing page.

cperciva22• 14 years ago

The point of a payment iframe is to keep javascript inside the frame from doing anything evil to the site outside the frame, not vice versa.

sergiotapia• 14 years ago

I would never ever use this. Too much of a security risk.

bentlegen11• 14 years ago

Please don't use this. There is nothing stopping paymentiframe.com from taking your customer's credit card numbers.

DASD4• 14 years ago

Ben, Are you going to be addressing this in your book, Third Party Javascript? Would love to hear your recommendations for how to handle payment processing such as this.

bentlegen11• 14 years ago

The book describes techniques that Stripe could use in developing their own iframed credit card form. I'd only trust a solution from them directly.

bryanlarsen• 14 years ago

By using this, you're saying that you trust cperciva more than you trust Stripe. I'm confident that neither are going to try and deliberately steal your credit card numbers. But furthermore, you are saying that cperciva is going to protect paymentiframe.com from hacks better than stripe is going to protect theirs.

Myself, I'd place a lot of trust on cperciva, the former FreeBSD security officer, a guy who has written papers on security flaws in Pentium 4 processors. (http://www.daemonology.net/hyperthreading-considered-harmful...)

[edit] paymentiframe.com's FAQ now includes this:

Why should I trust you with my credit card entry form?

You probably shouldn't. This is more of a proof of concept — but you might also want to use the CGI script to generate an iframe which you download (along with the bits it links to) and serve up as a static file from a server you run (but make sure you get a separate domain name for it).

semenko• 14 years ago

> Myself, I'd place a lot of trust on cperciva

Sure, but you can just compare the two sites' external measures of security, and they're not even close.

Stripe domains:

- Pass optional HTTP security headers (like X-Frame-Options on manage.stripe.com)

- Are pinned to Chrome's HSTS list (http://src.chromium.org/viewvc/chrome?view=rev&revision=...) and pass a Strict-Transport-Security header

tptacek12• 14 years ago

Do you use Typekit? Google Analytics? Mixpanel? Olark? Do those services get used anywhere in the path your users might take from your front page to the page in your app where you take credit cards? Then all those services can take your customer's credit cards too.

I frankly trust Colin Percival a lot more than I trust Olark. And I like Olark.

Your point is something Colin should address in his FAQ, and so it was good of you to make it, but it's also trivially knocked down.

bentlegen11• 14 years ago

> Your point is something Colin should address in his FAQ, and so it was good of you to make it, but it's also trivially knocked down.

So, you're saying that because Google Analytics could conceivably touch credit card information (using Stripe's JS), it's perfectly fine for some random guy with a suspect domain-name to?

I disagree.

bentlegen11• 14 years ago

Correction: If you're going to use this, please use the generated document and host it on your own domain.

kevinsimper• 14 years ago

This may be even more unsecure. Who would like their user to put in their creditcard information on a unknown site?

The change for that paymentiframe.com get comprimised I see is way higher, than Stripe is getting comprimised.

cperciva22• 14 years ago

The [chance] for that paymentiframe.com get compromised I see is way higher, than Stripe is getting compromised.

We'll have to agree to disagree about that. Not that there's anything wrong with Stripe's security, but I know a little bit about the subject too. :-)

gatordan• 14 years ago

I have to agree with everyone here that this doesn't make sense. I'm currently working on integrating Stripe into my application to create a subscription system. By far the easiest part has been payment form. In their tutorial they have a basic form that you can plug into a .html file and create test customers within minutes. It's laid out in 3 well documented steps in that link he calls "daunting".

estel• 14 years ago

Would using this service affect one's PCI DSS compliance?

cperciva22• 14 years ago

Not based on my understanding of PCI DSS.

jellicle• 14 years ago

Merchants are either required to be PCI DSS compliant themselves or outsource their card-handling only to third-party entities who are PCI DSS compliant themselves.

So, one of two things is true:

-- Paymentiframe/tarsnap is a PCI DSS compliant third party

-- the merchant is intentionally violating the PCI DSS rules by sending credit card data to you

So, which is it?

mrgreenfur3• 14 years ago

This is a lovely form. Ideally, Stripe would offer something like this as a way to quickly generate a nice cc entry form with the intention that site owners would put the generated code directly on their site, or that stripe would host the service themselves. After all, you're already trusting them to run the service, might as well trust them to run the form too.

Not that it's terribly hard to build a stripe-compatible form...

cperciva22• 14 years ago

site owners would put the generated code directly on their site

That would defeat the protection which the Same Origin policy gives you (since the iframe would have the same origin as the rest of your site).

or that stripe would host the service themselves

Yes, that would be much better.

mrgreenfur3• 14 years ago

I meant that they'd put it directly on their pages, no iframe needed. Agree that it'd be much better if Stripe just did it themselves.

staunch2• 14 years ago

If I was Stripe I'd be politely asking you to take this down. It's using their trademark (presumably) without permission and encouraging their users to do something very inadvisable.

Offering to host this seems like a really bad idea.

I know you're well meaning and trustworthy, but this shouldn't be run by a third party. For long term reliability reasons as much as security.

cperciva22• 14 years ago

I showed it to people at Stripe before announcing it.

staunch2• 14 years ago

Surprising that they would okay it, but their call I suppose.

dkl• 14 years ago

Showing it "to people at Stripe" and getting permission to use it are two different things.

lsh1232• 14 years ago

http://www.wepay.com/api

cperciva22• 14 years ago

Yes, we know that you work for WePay.

lsh1232• 14 years ago

Thanks. Great to be popular

Payment iframe - the easiest way to insert Stripe into your website

Related Stories