coltbg | Stripe Developers | Page 1

runic wigeonBOT Mar 23, 2023, 2:06 PM

#

fiery gorge Mar 23, 2023, 2:07 PM

#

Hi there

#

What is "stripe page" here?

#

You are seeing a card pre-filled in a Checkout Session?

kindred barn Mar 23, 2023, 2:11 PM

#

yes

#

I saw last CC, filled in redirected page

fiery gorge Mar 23, 2023, 2:12 PM

#

Gotcha, if you don't want that to occur then you need to detach the PaymentMethod from the Customer

#

Otherwise it will be pre-filled as we indicate here: https://stripe.com/docs/api/checkout/sessions/create#create_checkout_session-customer

runic wigeonBOT Mar 23, 2023, 2:16 PM

#

kindred barn Mar 23, 2023, 2:18 PM

#

is there any option to disable CC details on customer record or I need to create a new customer id on every donation which is subscription no matter that email address provided is the same ?

fiery gorge Mar 23, 2023, 2:19 PM

#

Like disable the credit card being saved to the Customer after the Checkout Session is completed?

kindred barn Mar 23, 2023, 2:20 PM

#

yes

fiery gorge Mar 23, 2023, 2:22 PM

#

No for Subscription Checkout Sessions that isn't possible.

#

I'm confused.

#

Why do you want to do this?

kindred barn Mar 23, 2023, 2:23 PM

#

on my donation site, which not required user-login user can subscribe for donation

#

but later if someone from other computer trying to make a donation, with same email address ( my server match email with customer id and pass it to checkout create session), on redirected page user will be able to make a payment with card which is not owned by him

#

fiery gorge Mar 23, 2023, 2:32 PM

#

Gotcha

#

So really what you want here is a better authentication mechanism on your end than just email.

#

Like you need an email/pw combo

#

And you only allow for one Customer per email

#

Otherwise they should use a different email and then you create a new Customer

kindred barn Mar 23, 2023, 2:37 PM

#

Hypothetically if some hacker in the future or even a malicious employee obtains my stripe sk. They can make a request to stripe to get all my subscribers's customerIds. Then all they need to do is use my **sk **+ **customerIds **to open a stripe page with prefilled data.

#

I was hoping stripe doesn't provide such an easy access to my subscriber's details.

fiery gorge Mar 23, 2023, 2:40 PM

#

I mean it is on you to safeguard your secret key. That isn't a realistic concern to be putting on our product behavior.

#

As I noted above, if you don't want the credit card to be pre-filled, then you detach it from the Customer.

#coltbg