Module 03
Checkout & the First Payment
Take one real payment, and know exactly which parts of it an attacker controls.
5 lessons · 7 videos · 3h 38m
- 03.01
Hosted, Embedded, or Your Own Form
Choose between a redirect, an embedded element and your own card form, and say what each choice does to the PCI questionnaire you have to answer.
- 03.02
The Amount Must Never Come From the Browser
Identify every field in a checkout request that the client controls, and move price, plan and identity to the server before an attacker moves them for you.
- 03.03
Intents, Authorization & Capture
Build a checkout that survives a customer closing the tab and coming back, by reusing one payment intent instead of creating a second.
- 03.04
What a Checkout Page Loses
Name the four checkout decisions that move conversion most, and say why the right payment methods matter more than the page design.
- 03.05
Test Mode Is a Different Planet
Exercise the whole money path against a sandbox, including replayed webhooks, and list what is still untested the moment you switch on live keys.