A certain payment gateway that I use allows two methods of integration:

  1. A hosted payment form, which you add to your website with an iframe.
  2. An API endpoint to send the payment details to using HTTPS (for styling your own forms).

I understand that, when configured correctly, the iframe solution is very bulletproof because it takes any mistakes out of the picture, so my question is regarding how the gateway handles method 2.

I was under the impression that HTTPS was an encryption mechanism that was perfectly suitable for transmitting payment details, however the gateway only allows API access across HTTPS for form fields that have been encrypted in the browser using JavaScript.

They provide a JavaScript library that performs what looks to be AES256 encryption on sensitive fields when your form submits. The JavaScript obtains a public key and nonce from the gateway, which is injected into the HTML form, and then specific fields (credit card, etc.) are encrypted before being sent over HTTPS to the gateway.

I can't work the following questions out myself:

Is HTTPS not suitable for sending payment details over? What information security issues is this solving? Does this method actually increase security? Does this method of data encryption have a name - is there somewhere I can read more?

  • you can hit the https api from an http page, might be CYA. – dandavis Aug 27 '18 at 20:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.