#zleb
cosmic geode
hello! can you elaborate in more detail what does the plugin script do?
worthy thistleBOT
long dragon
it gets info from the screen such as currency, amount then passes it to the payment intent w/ ajax call (we are using a proxy so that SK is hidden)
then in the same script we initialize a web form now using a Stripe instance with the public key
random hedge
As long as the secret key is not exposed to your client/front-end at all
long dragon
great to know! i was worried since the samples show that server must be involved but the purely frontend solution with checkout links is also not feasible from our side.
random hedge
Well, a secret key should only be used server-side yes
Hence my 'don't expose on the front-end' remark
I don't really understand the architecture you're describing
long dragon
it's a plug-in JS file that is called when user initiates a payment
random hedge
If it's client-side JS that runs in the browser then you shouldn't include your secret key(s) no
long dragon
it is hidden by a proxy URL that we are using, so the secret key is not visible in the script
random hedge
Yeah I don't really understand what you mean. That 'proxy' URL is still running in the browser and is still theoretically accessible and exposing your secret key, right?
long dragon
it doesn't show in the request headers anymore, but we set it somewhere in the application
random hedge
What is 'application'? Is it running in the browser client-side?
If i inspect the source of your page, am I likely to see the sk_xxx value?
long dragon
yeah...it can be set by the merchant in the web application when they have their own SK
random hedge
Then no, you shouldn't do that
What are you trying to build exactly? We generally discourage plugins collecting API keys from users
long dragon
this is for an existing ERP application used by merchants...the plugin script is because we wanted to have to choose between different payment gateways
we've done it with another provider previously now we are trying to do it with stripe
but yeah the amount can be seen in the request payload
random hedge
I don't really understand enough about the architecture/design of your plugin, but any client-side code that exposes a secret key is a security threat
long dragon
alright thanks, i'll raise this one with the team
random hedge
If a malicious user intercepts a secret key of one of your users it could be catastrophic as it would essentially grant them complete access to their Stripe account
An alternative to maybe consider would be a restricted key: https://stripe.com/docs/keys#limit-access
But still not perfect. If you're collecting any kind of keys from users as a part of your plugin then it needs to be done in a server environment where it cannot be intercepted