At one point, I looked at Braintree as a possible payment provider and checked their API. At that time, they had the Transparent Forwarding option, which resolved many PCI compliance issues without seeing the user on the payment provider website. This option posted the credit card information on the Braintree servers and sent back a 302 token redirect.
Now it looks like they are pushing the Braintree.js parameter, which encrypts the credit card information in the browser before sending it to the sellerβs website. My question is this:
What happens when javacript is disabled in the user's browser?
I understand that since input tags do not have a name attribute, they will not be placed, so there will be no security risk compared to plaintext numbers. But does a transaction just explode? Is there really no return for a customer who does not have JS for any reason?
Edit: To be clear, I am fully aware of how Javascript works in a browser, etc. This question is more specific for what is happening with the Braintree API itself and its options.
source share