#Guillaume-client_secret
lucid shell
Ok great. This means I can still give the customer a status report even if their session has timed out.
You guys rock! And thank you for being available here for questions!
dim elm
Happy to help!
lucid shell
Related security question: could someone iterate through client_secrets on my return_url page to try and leak info? Or will your api throttling catch this and make it unworkable?
dim elm
They could potentially hit rate limits, but it is possible that they could do this to some extent. However, the client_secret really can only be used to complete a payment, so it won't have a lot of sensitive information that can be accessed with it.
lucid shell
Yeah, the receipt_email seems to be the only thing really.
The question is then do I want to be as secure as possible and only rely on session data...
But that means if the customer takes a while to checkout, they wouldn't get a confirmation page.
or I can just auth the url... sorry, thinking out loud, I'll figure something out, thanks again for your help! 🙂
dim elm
No problem, it is a legit question. We don't think it is bad practice to have client_secret in the URL. We actually make reference to it being a query param in our docs: https://stripe.com/docs/payments/accept-a-payment?platform=web&ui=elements#web-submit-payment
lucid shell
Oh!