newb1 | Stripe Developers | Page 1

icy gorgeBOT Jan 13, 2023, 7:48 PM

#

woven ocean Jan 13, 2023, 7:49 PM

#

So is the card element in the iframe but your keypad is outside the iframe?

marble willow Jan 13, 2023, 7:50 PM

#

the card element is your api, inspecting shows its in an iframe

#

the keypad's on my site, as is the form

#

keypad works for all other fields in my form

#

just can't target the card elemtn field

woven ocean Jan 13, 2023, 7:54 PM

#

Gotcha. I'm not sure if this is possible actually. Let me check with a colleague

marble willow Jan 13, 2023, 7:54 PM

#

fyi like so

#

k

#

sidenote, kiosk server is win10 pro, can't use native on screen keyboard because extraneous keys like tab and space and other methods of circumventing broswer lock

#

this appears to be a xss issue

woven ocean Jan 13, 2023, 8:14 PM

#

So I discussed this some with a colleague and they think that programmatically filling in the card element is blocked in the same way that we prevent the card element from being prefilled with card details (for security purposes)

marble willow Jan 13, 2023, 8:14 PM

#

programmatically?

woven ocean Jan 13, 2023, 8:15 PM

#

Yeah assuming you're attempting to programmatically fill in the card element with javascript, no?

#

Based on input to the keypad

marble willow Jan 13, 2023, 8:15 PM

#

no

#

yes

#

but that's not the issue, native on screen keyboard works fine

woven ocean Jan 13, 2023, 8:16 PM

#

Because that's a native device keyboard. Your jquery one is attempting to use javascript to fill in the card element, right? So behind the scenes it's different

marble willow Jan 13, 2023, 8:16 PM

#

the javascript isn't filling in the field

woven ocean Jan 13, 2023, 8:16 PM

#

Oh

#

How does it work then

marble willow Jan 13, 2023, 8:16 PM

#

the js just creates the keypad

#

users have to type characters

woven ocean Jan 13, 2023, 8:17 PM

#

I understand. But since the keypad is created with jquery within the webpage, it must use javascript to fill in the fields with each typed character, right?

marble willow Jan 13, 2023, 8:19 PM

#

yeah

#

i guess that's a way to look at it, but again, that's not the issue

#

it's the iframe that's blocking it

#

due to xss

#

ok talking myself in circles, that is a js issue

#

i get it, but what's the solution

#

wait doesn't android etc osk use js?

#

why does android native osk work?

woven ocean Jan 13, 2023, 8:22 PM

#

I don't know if it will be possible currently with our security precautions. I can open up an issue internally to get folks to check on this/provide input, but it may be a bit before I get a response. So, I recommend you write into support: https://support.stripe.com/contact/email and mention my Discord handle: codename_duchess so that I can grab the ticket and provide you with an update when I hear back

Contact Us | Stripe: Help & Support

Find help and support for Stripe. Our support center provides answers on all types of situations, including account information, charges and refunds, and subscriptions information. Get your questions answered and find international support for Stripe.

#

The android keyboard is a native keyboard even though it's onscreen (in the same way windows can have a native on screen keyboard)

marble willow Jan 13, 2023, 8:23 PM

#

what other options are there for this situation then

#

i looked at payment links

#

but it's all capture, i just need to auth

#

i use setupintents, not payment

#

otherwise that'd be a great solution

woven ocean Jan 13, 2023, 8:25 PM

#

Wait how would payment links solve this problem?

marble willow Jan 13, 2023, 8:25 PM

#

instead of card element it would be a qr code the user could scan

#

but in looking at it, code sends to a payment page

#

no option that i could see to just auth, not capture

#

even if i went with capture, it charges minimum .50

#

so can't set capture to zero

#

unless i'm missing it, is there a way to have a payment link that only authorizes?

#

will likely use payment links in this manner now that i know about it though

woven ocean Jan 13, 2023, 8:31 PM

#

So after you collect the customers' payment info, how long after are you going to capture funds for the payment?

marble willow Jan 13, 2023, 8:32 PM

#

it's not a capture, it's an auth

#

the only time it ever gets captured is if they don't show for the reservation, which is rare

#

that's why setupintents api is used

woven ocean Jan 13, 2023, 8:33 PM

#

Gotcha. But how long after the auth would you capture in that scenario

#

Or can it vary wildly

#

Will it ever be > 7 days

marble willow Jan 13, 2023, 8:34 PM

#

well successful capture depends on the user's bank as you know

woven ocean Jan 13, 2023, 8:34 PM

#

Yeah

marble willow Jan 13, 2023, 8:34 PM

#

but we've never lost a dispute

woven ocean Jan 13, 2023, 8:34 PM

#

All I'm asking is what's the max possible amount of time between your auth and capturing their funds

#

If they don't show for a reservation

marble willow Jan 13, 2023, 8:35 PM

#

i don't have a specific memory of the longest time delta, i think one was two months later

#

too rare to recall

woven ocean Jan 13, 2023, 8:36 PM

#

Ah ok

#

So separate auth and capture with payment links isn't an option then

marble willow Jan 13, 2023, 8:36 PM

#

and the capture is done in the stripe dash as creating a charge

#

think you're thinking subscription with delayed capture

woven ocean Jan 13, 2023, 8:37 PM

#

No I'm not. Just separate auth and capture with a single payment

#

That would be an option if the time delta is a max of 7 days

#

But not an option for you

#

If you're ok with implementing your own qr code you could use a checkout sesion: https://stripe.com/docs/payments/save-and-reuse

Set up future payments

Learn how to save card details and charge your customers later.

marble willow Jan 13, 2023, 8:38 PM

#

that's basically what i'm doing now, setupintents

woven ocean Jan 13, 2023, 8:39 PM

#

Yeah so that could be an option, but there's not a built in qr code like with payment links

#

You'd need to implement it yourself

marble willow Jan 13, 2023, 8:40 PM

#

ok but how do i do that

#

obviously i can create a qr code

#

but what would it point to

#

and how would it capture the card details and put them in our dashboard

#

k wait let me think about that for a second

#

youre saying create like a qr code which when scanned, would send user to a page on their device

#

where they could use whatever payment source

#

(like in payment links)

#

but that page would have the card element in it

#

api that is

woven ocean Jan 13, 2023, 8:46 PM

#

You could do it that way if having a user pay on their device is acceptable for your flow

#

You wouldn't need to use the card element. You could use a checkout session if you like

#

But either way works

marble willow Jan 13, 2023, 8:46 PM

#

checkout session i guess

#

as it's not a payment

woven ocean Jan 13, 2023, 8:47 PM

#

Well you can use Sessions or Elements. Either would work with SetupIntents

marble willow Jan 13, 2023, 8:49 PM

#

is there anything in the docs about nfc

#

i couldn't find

#

that owuld be the best solution, attach an nfc reader to the kiosk and let them scan their card that way

#

but not sure if stripe api grabs that

woven ocean Jan 13, 2023, 8:52 PM

#

That would be our terminal product: https://stripe.com/en-gb-us/terminal

Stripe Terminal | SDKs, APIs, & Pre-Certified Card Readers

Stripe Terminal is a set of APIs and pre-certified card readers allowing businesses to accept in-person payments and build custom omnichannel experiences.

#

For accepting in person payments

#

This is what the flow would be for you: https://stripe.com/docs/terminal/features/saving-cards/overview

Save cards for online payments

Use your Stripe Terminal integration to collect card details for online reuse.

marble willow Jan 13, 2023, 8:53 PM

#

is it weatherproof

woven ocean Jan 13, 2023, 8:53 PM

#

I don't think so but not sure

marble willow Jan 13, 2023, 8:54 PM

#

k will look into it, thanks for your assistance

#newb1