javascript - Paypal 快速结帐集成安全问题

Question

如前所述，有 3 种方式可以执行和创建付款 here

1. 客户端 REST
2. 服务器端 REST
3. Braintree SDK

我们使用的是客户端 REST。在他们的网站上找到的代码集成:

paypal.Button.render({

        env: 'sandbox', // sandbox | production

        // PayPal Client IDs - replace with your own
        // Create a PayPal app: https://developer.paypal.com/developer/applications/create
        client: {
            sandbox:    'AZDxjDScFpQtjWTOUtWKbyN_bDt4OgqaF4eYXlewfBP4-8aqX3PiV8e1GWU6liB2CUXlkA59kJXE7M6R',
            production: '<insert production client id>'
        },

        // Show the buyer a 'Pay Now' button in the checkout flow
        commit: true,

        // payment() is called when the button is clicked
        payment: function(data, actions) {

            // Make a call to the REST api to create the payment
            return actions.payment.create({
                transactions: [
                    {
                        amount: { total: '0.01', currency: 'USD' }
                    }
                ]
            });
        },

        // onAuthorize() is called when the buyer approves the payment
        onAuthorize: function(data, actions) {

            // Make a call to the REST api to execute the payment
            return actions.payment.execute().then(function() {
                window.alert('Payment Complete!');
            });
        }

    }, '#paypal-button-container');

这样安全吗？

client: {
            sandbox:    'AZDxjDScFpQtjWTOUtWKbyN_bDt4OgqaF4eYXlewfBP4-8aqX3PiV8e1GWU6liB2CUXlkA59kJXE7M6R',
            production: '<insert production client id>'
        },

我们在客户端公开我们的客户端 ID，其他人可能能够获取和使用它。

感谢和更多的力量

Answer 1

看起来没有人回答这个问题，可能是其他搜索过它的人。好吧，其他人在此处对同一问题的评论中回答了这个问题 paypal express checkout security with cilent ajax call