9 ms·
Prompting users to enter payment information over unsecured HTTP...smart.
by whitehat2k9 10y ago
Prompting users to enter payment information over unsecured HTTP...smart.
- daw___ 10y agoYep, although the form posts to a secure URL: https://api.stripe.com/v1/tokens https://api.stripe.com/v1/tokens
- Gurrewe 10y agoDoesn't make it better tough, a MITM could change the action URL of the form.
- staticfish 10y agonot if it's pinned at the web app level.
- tyre 10y agoAgain, MITM. If you mean the front-end web (JS) app, MITM the request from the server to the client browser and replace the hardcoded submission url in the JS.
- staticfish 10y agoNot really. I used Play Framework which is also its own webserver. SSL is at both the app and webserver level.
- jgalt212 10y agoMITM requires a man in the middle. For the most part, a state level adversary is required for a generalized MITM attack.
- megabytemike 10y agoCome join my wifi network at the coffee shop :-D
- jgalt212 10y agoYes, but that's not a general MITM attack as the NSA has pulled off. Only the folks at that particular coffee shop are placed at risk from this particular adversary.
- ryanbertrand 10y agoUsually Stripe throws warnings into the console for using their JS lib while on a HTTP site.
- ataylor32 10y agoSee http://www.troyhunt.com/2013/05/your-login-form-posts-to-https-but-you.html http://www.troyhunt.com/2013/05/your-login-form-posts-to-htt...
- r1ch 10y agoSeriously! It's 2016, unless you rely on 3rd party resources that don't support HTTPS there's no reason why your site shouldn't be HTTPS only. Certificates are free and there's negligible performance overhead with modern CPUs.
- poincare101 10y agohttps://enveloupe.com/api/new https://enveloupe.com/api/new
- lol768 10y agoLooks like it does support HTTPS but there's no redirect & HSTS in place to force use of the secure site which is odd.