stripe-js VS stripe-payments-demo

At ReadMe, we’re constantly keeping an eye on the best DX out there, and we’ve come to notice a trend. Many of the top API-first companies out there offer their own custom SDKs, such as Stripe, Twilio, and Plaid (and I’m only linking to their JavaScript SDKs!).

Due to PCI compliance requirements, the Stripe.js library has to be loaded from Stripe's servers. This creates a challenge when working with server-side rendered apps, as the window object is not available on the server. To help us manage that complexity, Stripe provides a loading wrapper that allows importing Stripe.js like an ES module:

This approach was no different when I started thinking about the SprintDock website (a working title) and backend infrastructure needed for the first time back in April 2021, when I was still working full-time. This was until I started playing around with Stripe JS.

Stripe.js should not require React to run - I wouldn't recommend using React unless you want it for some other reason. Maybe check out the docs here for how to get started? https://stripe.com/docs/js

Implement Stripe JS to collect card details and convert to token on the frontend

That’s all for this tutorial. Hopefully it has given you an understanding of how to process Stripe payments in a Node.js application. There are many more configurable options available not used in this tutorial. To discover all these options the offical Stripe.js documentation is an excellent resource.

Thank you to our top open-source contributors this month: marcoscannabrava, viablecell (stripe-js), williammartin (stripe-node), jmarkowski, kronthto, hibariya (stripe-samples), alihussain5, Morriar, tophattom, richardxia, RyanBrushett, karmakaze, alexdunae, Bo98, kddeisz (sorbet).

For a payment gateway, you should check out Stripe. You can use their JavaScript SDK which allows you to take payment (https://stripe.com/docs/js). A competent developer with experience in these SDKs could wire up a payment gateway anywhere between a day and a couple of days.

https://github.com/stripe/stripe-js strikes perhaps the most realistic balance possible, recognizing that NPM is an insecure place for their core JS logic that creates a PCI compliant iFrame, and so their NPM package is just a loader for a script tag hosted securely. And yet they encourage people to use NPM for the wrapper itself. Which is just as vulnerable to supply chain attacks as anything else on NPM. If this isn't tacit acknowledgement of a "new standard" I don't know what is. I absolutely agree that it's problematic.

Even in your linked doc has a link for the demo application has server backends: https://github.com/stripe/stripe-payments-demo/tree/master/server

While saving the card, by default Stripe will accept the duplicate card number (i.e., it will accept the same card number more than once). It is actually a bug in the Stripe side still not resolved. This is not the real case scenario as no two people will have the same card number. But we have to take care of that in the accidental entry.