Stripe Payments Integration

Secure payment flows with webhook handling, idempotency, and SCA support.

Checkout Sessions

BAD: Client-side price, no idempotency

// ❌ Trusting client data, XSS risk
app.post('/checkout', async (req, res) => {
  const { priceId, amount } = req.body; // Never trust client
  const session = await stripe.checkout.sessions.create({
    line_items: [{ price: priceId, quantity: 1 }],
    success_url: req.body.successUrl, // XSS risk
  });
  res.json({ url: session.url });
});