medipass / react-payment-inputs

A React Hook & Container to help with payment card input fields.
https://medipass.github.io/react-payment-inputs
342 stars 62 forks source link

Avoid leaking sensitive data, remove "name" attribute from form fields #47

Open alexsegura opened 4 years ago

alexsegura commented 4 years ago

Hi! Thank you for this component 🙂

When using credit card forms, generally it's a good idea to avoid sending sensitive data to own servers (unless you are PCI/DSS compliant). Currently, the component adds a name attribute to all fields, making it possible to send credit card information to own servers by mistake.

IMHO, adding the name attribute should be opt-in only, for example like this:

getCardNumberProps({ withNameProp: true })

What do you think? This would be a breaking change, requiring a major version bump.