安全的 PayPal Checkout 客户端?-前端问题

Secure PayPal Checkout Client-side?(安全的 PayPal Checkout 客户端?)

本文介绍了安全的 PayPal Checkout 客户端?的处理方法，对大家解决问题具有一定的参考价值，需要的朋友们下面随着小编来一起学习吧！

问题描述

他们声称，通过 paypal 的客户端结帐，您可以简单地将他们的代码放到您的网站(前端)上.然而，从这个例子来看，用户可以修改请求的金额，因为代码在客户端上(从不信任客户端").

With paypal's client side checkout they claim you can simply drop their code onto your site (front end). However, from this example it looks like a user could modify the amount requested because the code is on the client ("Never trust the client").

是否可以保护它或是否需要服务器端代码?

Is it Possible to secure this or is server side code necessary?

代码直接来自demo

<!DOCTYPE html>

<head>
    <!-- Add meta tags for mobile and IE -->
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
</head>

<body>
    <!-- Set up a container element for the button -->
    <div id="paypal-button-container"></div>

    <!-- Include the PayPal JavaScript SDK -->
    <script src="aHR0cHM6Ly93d3cucGF5cGFsLmNvbS9zZGsvanM/Y2xpZW50LWlkPXNiJmFtcDtjdXJyZW5jeT1VU0Q="></script>

    <script>
        // Render the PayPal button into #paypal-button-container
        paypal.Buttons({

            // Set up the transaction
            createOrder: function(data, actions) {
                return actions.order.create({
                    purchase_units: [{
                        amount: {
                            value: '0.01'
                        }
                    }]
                });
            },

            // Finalize the transaction
            onApprove: function(data, actions) {
                return actions.order.capture().then(function(details) {
                    // Show a success message to the buyer
                    alert('Transaction completed by ' + details.payer.name.given_name + '!');
                });
            }


        }).render('#paypal-button-container');
    </script>
</body>

问题描述

推荐答案