5 ms·

From the article: > Stripe POSTs at a /tokens API endpoint over https, which means everything is encrypted including the query params

• joosters 13y ago
  It's still a little unclear: It says that it is a POST, but the URL in the box above contains the card details. Further, the bit of text you quote goes on to say: > ...including the query params. These params include the card number, expiration date, and CVC The URL they give as an example is: https://api.stripe.com/v1/tokens?email=foo%40example.com&payment_user_agent=Stripe+Checkout&amount=0&iovation_blackbox=a_very_large_string>&card[number]=4242+4242+4242+4242&card[cvc]=123 https://api.stripe.com/v1/tokens?email=foo%40example.com&pay... &card[exp_month]=4&card[exp_year]=2014&card[name]=foo%40example.com&key=pk_test_6pRNASCoBOKtIshFeQd4XMUh&callback=sjsonp1390180955159&_method=POST So are these params in the URL, or not?
  • mmcnickle 13y ago
    No, the output in the box is from the web console, which uses the GET-style URL as a concise way of showing POST requests.
    • joosters 13y ago
      Ah, I see. Thanks for the clarification!