Verifybuyer() may cause information leak

Questions
1

In the examples here to verify a buyer:

It’s suggesting that personal information can be exposed. Imagine a hacker going into a store where payments are processed by square then when the credit card boxes pop up, he views the HTML source code.

If he finds information like this:

 billingContact: {
      addressLines: ['123 Main Street', 'Apartment 1'],
      familyName: 'Doe',
      givenName: 'John',
      email: '[email protected]',
      countryCode: 'GB',
      phone: '3214563987',
      state: 'LND',
      city: 'London',
    },

surely he would try to scam the customer.

Such a scenario would be likely in shops where the seller wants to save the customer’s information in advance before making the payment.

A customer doesn’t want to enter the same information many times to complete payment.

In my case, I create customers with the Square API and I receive a customer ID. Can I somehow inject that ID into the VerifyBuyer function then square’s datacenter can convert the ID behind the scenes into the actual customer data? That way, no personal info will be exposed (even in HTML code) when it comes to entering credit card information.

2

Since your using the Customers API for first securely store the customer information on file you can then pass the necessary customer information to the verifyBuyer so the customer isn’t entering the information twice. It will be similar to our documentation for Charging a Card on File with SCA. :slightly_smiling_face:

3

I ended up doing alot of code editing but what I do is i have a form to take customer info. On submission, I get an ID that will be used for the entire payment session, and only the ID should be exposed if anything.

Because your verifybuyer function expects raw customer details, I couldn’t simply pass the ID in. Therefore I have to call my server again to retrieve the customer information based on ID via your retrievecustomer api call. This slightly increases the time one has to wait to complete payment.

Thats some overhead just to pass customer data and I certainly don’t want to pass the customer information as part of an HTTPS request or even in code (like your examples show).

4

We’re constantly working to improve our features based on feedback like this, so I’ll be sure to share your request to the API product team. :slightly_smiling_face: