Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to understand what is the best way to implement a credit card payment flow into a native iPhone app. From what I see on the market, most of the apps use a WebView to process the payment. I haven't found examples of native implementation of it. What are the drawbacks of a native solution? Is either one of these solutions PCI compliant?

share|improve this question
Just use a payment processor like PayPal – Ramhound Mar 2 '12 at 17:29
I can't. I need to offer Visa, Mastercard and all the most important circuits for the payment. Moreover, the website doesn't use paypal and that would be a significant difference in the UX. – piede Mar 3 '12 at 8:12

Using a WebView makes a lot of sense.

  • You have to be connected to the Internet anyhow.
  • Performance is not an issue.
  • There's lots of already written and well tested web-based payment processors.
  • Many people (and you specifically) already have a web-based payment processor in place for non-mobile uses.
  • More secure since as much as possible is on your servers rather than in the client.
  • Apple less likely to demand you use the built-in payment systems (with their cut).

PCI is not really optional, so if someone has a working business based on payment from iPhone via WebView then it's going to be possible to meet PCI.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.