I'm asking here because there seem to be zero resources online about this kind of thing. I've built an single page e-commerce website that uses Stripe, Laravel, VueJS, Vue Router and Vuex.
Everything works perfectly. This is the checkout process for the payment:
- User enters card details using Stripe Elements which generates a Stripe card token (from within an iframe, so no PCI issues there)
- This card token is then given to the server through an AJAX request, where it stores the card token against the order in the database
- When the user clicks "confirm", the charge is completed using the stored card token
I can't seem to find any other websites that use checkout SPAs so my question is, can you see any potential security issues here? I've been debating whether to just rebuild this thing using the traditional approach, but the way it works currently is seamless and so easy to use.