#stripe

I have an app that uses Stripe. I do not store any payment information locally and rely on the Stripe API to allow customers to access their billing history with us. Right now I provide customers with the ability to change their credit card but I want to provide them with the option of removing their credit card from their account entirely. According to the

stripe docs the only way to accomplish that is to delete the customer entirely. By deleting the customer they would no longer be able to access their billing history (which I am looking up using their customer ID) ... Is there some other way to approach this aside from importing all of the data and storing it locally so that, should they remove their card

information and I delete the customer object, they would still have access to the billing history?

Sorry for the wall of text!

brandon272: why not just delete the card?

markin: Hmm... Can I? Why do I think that you can't? I haven't tried doing it recently. But there's this: https://support.stripe.com/questions/can-i-dele...

Let me try it now.

markin: Yeah, worked just as I needed it to. Who knows why I thought that you couldn't! What does that FAQ entry mean?

I think it means that you cannot have a customer that has cards without one of those cards being set as the active card

"If you'd like to keep the customer object in your Stripe account, then we don't currently offer a way to delete the active_card field."

ahh... ok

Makes sense

i have a concern about the security of using stripe.js in my phonegap app

similar to this post: https://stackoverflow.com/questions/23769056/se...

What's the concern

Stripe.card.createToken({ number: card.pan, cvc: card.cvc, exp_month: card.expMonth, exp_year: card.expYear }, resHandler)

i think i'm sending the user's cc info over an insecure connection

i don't really know this though

znn: the connection to Stripe would be over an https connection

i just found out cordova does indeed support ssl

It's just like using Stripe.js on a page being loaded over regular HTTP in a browser.

The page itself is HTTP but the requests being sent to Stripe are over SSL

this is good news

normally you'd also want the page itself to be HTTPS to avoid any man in the middle attacks, but stripe's api only accepts stuff over HTTPS

(I tend to avoid using the term SSL, becuase SSL isn't used anymore, its TLS)

now if i'm going to send the token and an email associating that token to my server, i suppose i should also use ssl on my end for security reasons

oh

thanks markin

otherwise an attacker could charge away just with the token

the token is tied to your account

you tend to want https because you don't want your customer's private data to be transmitted in plain text where anyone could easily grab it

markin: how to verify my managed account? is it necessary to verify?