Timeline for PCI compliance dilemma
Current License: CC BY-SA 4.0
13 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 29, 2019 at 9:18 | vote | accept | Marcus Horne | ||
| Jan 29, 2019 at 1:12 | answer | added | Bobson | timeline score: 1 | |
| Jan 28, 2019 at 14:39 | comment | added | Josef | Then you might need a different payment provider. The usual flow is such, that credit card data is only sent to the payment provider by the client and you never get to see it. Anything else means much more work for you regarding PCI compliance. | |
| Jan 28, 2019 at 12:25 | comment | added | Marcus Horne | I need to use both to authenticate the request | |
| Jan 28, 2019 at 12:22 | comment | added | schroeder♦ | Yes, unless the API key is unique to the client, secret keys should not be client-side | |
| Jan 28, 2019 at 11:30 | comment | added | Marcus Horne | Ok, sure, I get your point. My point is I dont mind needing to redesign how it works, but passing the API keys to the client is bad design from a security standpoint, right? | |
| Jan 28, 2019 at 11:13 | comment | added | schroeder♦ | That's part of the API flow, isn't it? Where the keys are, and what triggers the API are all part of your flow. | |
| Jan 28, 2019 at 11:10 | comment | added | Marcus Horne | It's not so much the API flow I am worried about. Surely exposing the API key/secret in the browser would allow just anyone to control our 3rd party payment processing service? I'm not sure if I feel comfortable doing this. | |
| Jan 28, 2019 at 10:57 | comment | added | schroeder♦ | Sending from the client to the payment processor is the normal way to do it. If it breaks your API flow, then you might need to redesgn your API flow. | |
| Jan 28, 2019 at 10:29 | comment | added | Marcus Horne | The discussion is between a backend coworker, my CTO and myself. They are both telling me we should send the data from the client and PCI forbids me from sending the data to another service. We are a small/medium sized company, our QA doesn't handle such matters. | |
| Jan 28, 2019 at 10:14 | comment | added | schroeder♦ | Who is telling you this? What does your QC say? | |
| Jan 28, 2019 at 10:05 | review | First posts | |||
| Jan 28, 2019 at 11:54 | |||||
| Jan 28, 2019 at 10:04 | history | asked | Marcus Horne | CC BY-SA 4.0 |