#stickyou69
next escarp
main garden
Hi there 👋 I'm not quite sure I'm understanding, you're saying the return URL that you're being redirected to after a payment has been completed contains the client secret in that URL?
Or is it passing the client secret to the front end that you're hesitant to do? That's safe to do, and a lot of functions in our client-side library need a client secret to use. You should avoid logging that secret though.
brazen torrent
yes it is contained in the url
it adds to the return url
?payment_intent=xxx&payment_intent_client_secret=xxx&redirect_status=succeeded
this exposes to the url
also last time I asked this you guys said it was not an issue
but now I see in the docs it is not good to expose secret
main garden
It's not good to log that secret, and you should try to keep it as secure as possible, but at the end of the day it's a secret that is designed to be sent to client-side code so it's not possible to avoid exposing it altogether.
brazen torrent
yes but in the url is a different story
say if they are streaming or making video
or send it to someone for whatever reason
main garden
If they're hitting your return_url, then I'm pretty sure the payment has completed at that point and the client secret no longer holds any power
brazen torrent
could be processing and then failed
and then still holds power?
I can retrieve the secret using api so its not visible, but the stripe js will still include it in the url... can I configure it to stop
main garden
Not that I'm aware of
brazen torrent
or can the confirmation / return url use only the payment intent id for checking status
rather than secret & id
main garden
No, not that I'm aware of