1

My company has a PCI compliant billing gateway and they expose a service for submitting credit card payment details.

I am writing a (Single Page Application/end-to-end javascript) website for them that is on a different domain than this billing gateway so naturally calling this service from javascript in the client (browser) violates the same-origin policy.

In the past, I have used proxies to get around same-origin policy issues. I would like to do something similar in this situation. However, I don't have access to the trusted internal network on which PCI compliant billing gateway resides so I can not put my proxy server there.

Is there such a thing as a reverse proxy that does SSL on both sides? Or how would I go about setting up a PCI compliant proxy solution?

Improve this question

1 Answer 1

Reset to default
1

I see two problems. Firstly, if the javascript handles the credit card details, the server providing the javascript must be PCI-DSS compliant. Secondly, any reverse proxy that abstracts/merges the underlying domains must also be PCI-DSS compliant, otherwise an attacker can simply subvert the proxy to point elsewhere.

So a PCI compliant proxy would be the best way to go. See 'How a reverse proxy can help you achieve regulatory compliance' section of this article. Or better yet, read this article about scoping the PCI compliant environment.

The basic principle is the same as any proxy for PCI-DSS: You secure the proxy, you secure network and you secure any application and database servers. As this list of servers and asset can grow quite quickly, the recommended approach is to only have one user<->company relationship/route for transferring credit card details. Your new application creates another relationship/route, hence the extra work.

Improve this answer
1
  • It's hard to say without knowing more, but I would also suggest you figure out if your application falls into PA-DSS scope, which would add to the guidance and burdens available to you.
    – gowenfawr
    Commented Sep 28, 2013 at 18:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .