I'm looking into using Stripe.js for payment processing in a mobile web application wrapped in Cordova. According to the Stripe documentation all checkout pages should be served over https. Since Cordova will technically be serving these pages locally in a webview, are there any security concerns I should worry about?

Note: I will still be using https to submit the tokenized card details from Stripe to my remote API server to actually complete the charge.

up vote 28 down vote accepted

I'm an engineer at Stripe.

Cordova/PhoneGap isn't a platform we actively support with Stripe.js, but after talking it over with the team, we have two suggestions for how to mitigate potential vulnerabilities:

  1. Configure your Domain Whitelist sensibly, to limit the possibility of other scripts maliciously sending payment data to an untrusted third party. You should only need to add https://api.stripe.com to support communicating with Stripe.
  2. Always load the latest version of Stripe.js from our servers, per the Stripe.js documentation. This will ensure that you're always up-to-date with any bugfixes and patches we add to Stripe.js

Beyond that, I believe your exposure is similar to using Stripe.js in a normal webpage, loaded in-browser.

(I should note that I assume you're using Stripe.js and not Stripe Checkout—the latter would require the https://checkout.stripe.com domain to be added to the domain whitelist, as well.)

  • Wow wasn't expecting to get someone from Stripe, thanks for your excellent reply! This is along the lines of what I was thinking, I will be sure to implement the whitelisting. – TyndieRock May 20 '14 at 23:19

I posted an answer related to this in a similar question. If you control a custom API, give it https protection and send your whole checkout form down into an iframe (source set to your API endpoint).

Then use a plugin like Cordova-HTTP for SSL pinning, and you should be more secure!

Original answer: Implement Stripe Payment Gateway in Cordova/Phonegap Application

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.