A certain payment gateway that I use allows two methods of integration:
- A hosted payment form, which you add to your website with an iframe.
- An API endpoint to send the payment details to using HTTPS (for styling your own forms).
I understand that, when configured correctly, the iframe solution is very bulletproof because it takes any mistakes out of the picture, so my question is regarding how the gateway handles method 2.
I can't work the following questions out myself:
Is HTTPS not suitable for sending payment details over? What information security issues is this solving? Does this method actually increase security? Does this method of data encryption have a name - is there somewhere I can read more?