Hacker News new | ask | show | jobs
by terrellm 4898 days ago
Wow looks nice. Is an SSL certificate still required since the JS is on Stripe's secure server?
3 comments
jackowayed 4898 days ago
Yes. Otherwise an attacker could serve a page that looks just like your page, but has different javascript that ships them the credit card numbers.

If you're not using SSL, you should just assume that an attacker can break your page in every conceivable way.

link
latortuga 4898 days ago
Yes, absolutely 100% yes an SSL certificate is still required. Look up mixed content warnings and why they're a bad thing.
link
ceejayoz 4897 days ago
You get a mixed-content warning for HTTP on HTTPS, but not HTTPS on HTTP as you're already insecure on the original page anyways.
link
durkie 4897 days ago
fwiw -- my site is hosted with a company that doesn't have ssl, and we just direct our payments over to a heroku page, which is served by ssl on their free plan.
link