nrh-cklimas

[grave gorge]

Do you have specific concerns?

[fallen wasp]

our use case is we allow our users to customize the page that a Payment Element appears on in a limited way. It should just be cosmetic stuff like fonts and colors but we want to lock it down as much as possible. wondering for example if...

1. we should put the Payment Element on a dedicated page that our users have no customization ability around

2. we should isolate it from the rest of the page in some other way

We're not concerned about Stripe itself being insecure, we just want to isolate it from other content to the degree that's feasible, if that makes sense.

[sharp coral]

The PaymentElement is rendered inside an iframe, so it is typically running in an isolated environment

[fallen wasp]

d'oh! I missed the iframe in the element inspector.

that answers my question, thanks