|
Brian Maggi
|
January 27, 2013 at 7:55 pm
I was reading on the Stripe site the following:
SSL is required when you use Stripe.js to make live charges. If you aren’t using Stripe.js, you’ll also need to ensure your server is fully PCI compliant.
Does the Event Espresso Stripe gateway use stripe.js, or is this even relevant?
Just curious because of the message from Stripe.
|
|
Josh
|
January 28, 2013 at 8:31 pm
Hi Brian,
It appears that the Event Espresso Stripe integration does not use Stripe.js. We didn’t originally develop it (a third party did and donated the code to us and it’s been maintained by ee since then).
I’ve opened a ticket with the dev team to get the Stripe integration using Stripe,js, because that is one of the great things about Stripe and the ee integration should be taking full advantage of Stripe’s system.
|
|
Brian Maggi
|
January 29, 2013 at 4:33 am
Josh
Thanks for the response. Sounds good. According to the Stripe website, it’s one of several things you can do to help get ones site PCI compliant.
Brian
|
|
Chris Reynolds
|
January 29, 2013 at 9:39 am
Brian —
Using the existing Stripe gateway won’t make your site not PCI compliant, assuming you have an SSL certificate. My understanding is that the stripe.js just adds better encryption to the data transmission, but that’s something unique to Stripe, specifically. Other gateways handle transmitting personal and CC information the same way the current Stripe gateway does.
|
|
Brian Maggi
|
January 29, 2013 at 9:55 am
From what I have read, even going with the Stripe.js won’t be enough to make a site PCI compliant. Most of it will come down to other security issues on the server – stuff beyond the scope or responsibility of EE.
We’ve got SSL set up on our site, so that’s a good.
Thanks,
|
|
Josh
|
January 29, 2013 at 10:01 am
Hi Brian,
The other thing I’ve read on PCI compliance is disabling FTP and using SFTP instead.
|
|
Brian Maggi
|
January 29, 2013 at 10:16 am
Josh
I didn’t know what I was in for when I started reading up on PCI. Suffice to say, like any security issue you’re in for an ongoing battle to stay up to speed.
Brian
|
|
Josh
|
January 30, 2013 at 3:11 pm
Hi Brian,
Agreed, and I do hope we can include stripe.js in a not-so-distant update.
|
