search

Glench / ExtPay

The JavaScript library for ExtensionPay.com — payments for your browser extensions, no server needed.
https://extensionpay.com
Other
483 stars 62 forks source link

extpay.openPaymentPage() opens a popup without indicating anything about security or location ... #228

Closed escape75 closed 1 month ago

escape75 commented 1 month ago

Although technically not a bug, I'm wondering if anything can be done to assure the buyer that they are visiting a legitimate site ...

I've had someone contact me saying that they were unsure if this was served over https and where the popup was served from, and of course they could perform a "view source code" on the popup to get that info, however I do get their point :)

escape75 commented 1 month ago

One can adjust the code for open_popup to perform a window.open to correct this if needed …

Glench commented 1 month ago

Hey! I saw you closed this, but you might like to know that in ExtPay 4.0 we're going to use Stripe Checkout which might help your buyers feel like it's a more "legitimate" site. That said, developers have already made hundreds of thousands of dollars using ExtPay so it doesn't seem like it's been much of a barrier for potential customers.

escape75 commented 1 month ago

Sounds great. Thank you for the update!

Yes I did close it after I realized one could just modify the popup code to open the window with whatever UI features are required via window.open

Thanks! Martin

On Mon, Jul 29, 2024 at 07:24 Glen Chiacchieri @.***> wrote:

Hey! I saw you closed this, but you might like to know that in ExtPay 4.0 we're going to use Stripe Checkout which might help your buyers feel like it's a more "legitimate" site. That said, developers have already made hundreds of thousands of dollars using ExtPay so it doesn't seem like it's been much of a barrier for potential customers.

— Reply to this email directly, view it on GitHub https://github.com/Glench/ExtPay/issues/228#issuecomment-2255942811, or unsubscribe https://github.com/notifications/unsubscribe-auth/ABST42I7RGM4BG4YVDEBZULZOY7CTAVCNFSM6AAAAABLFT4BTOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDENJVHE2DEOBRGE . You are receiving this because you modified the open/close state.Message ID: @.***>

Glench commented 1 month ago

Sure, but for you and anyone else — we really wouldn't recommend this approach! The popup page is not designed to be viewed full-screen and may change at any time, resulting in a less than ideal or even broken experience for your customers. If you want to take that risk that's up to you, but we only officially support the popup window at the moment.

escape75 commented 1 month ago

Thanks for the suggestion!

Right now, I am simply modifying the open_popup code:

async function open_popup(url, width, height) { window.open(url, null, toolbar=no,location=no,directories=no,status=no,menubar=no,width=${width},height=${height},left=${(screen.width-width)/2},top=${(screen.height-height)/2}); }

On Tue, Jul 30, 2024 at 7:58 AM Glen Chiacchieri @.***> wrote:

Sure, but for you and anyone else — we really wouldn't recommend this approach! The popup page is not designed to be viewed full-screen and may change at any time, resulting in a less than ideal or even broken experience for your customers. If you want to take that risk that's up to you, but we only officially support the popup window at the moment.

— Reply to this email directly, view it on GitHub https://github.com/Glench/ExtPay/issues/228#issuecomment-2258420488, or unsubscribe https://github.com/notifications/unsubscribe-auth/ABST42LD5R5KYCGRXRVQQNDZO6LXJAVCNFSM6AAAAABLFT4BTOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDENJYGQZDANBYHA . You are receiving this because you modified the open/close state.Message ID: @.***>