I've been evaluating a credit card processing system and I'm trying to decide between the two options provided for processing payments
Option one is
- Capture the sensitive data in regular HTML Input fields (i.e. no binding to Apex controller)
- Use a function in JS Library to get a token for that data from provider via HTTPS
- Pass token to the Apex Controller and make callout to a REST API to charge the card.
This is the flow they recommend, primarily I think because it avoids any sensitive data ever being passed to the server on the requester side.
The second option is to capture all the data in regular inputFields bound to the Controller, and charge the card via a HTTPS callout to the provider's REST API that would include info like the CC number
Wondering if other folks have approached the same problem, and what else I should be considering?