Is it safe for POST credit card data from View to Controller?

Question

Need to send some CC data from the view to the controller, where it will be processed, can I just send it or is there some general way to ensure the data is safe on the go?

Answer 1

Put data using SSL .

Here is a good resource for configuring SSL with IIS and ASP.NET .

Answer 2

SSL wiring, as mentioned in Rex M, is certainly the first step. You should probably make a page on which they print their credit card number. This will give your users a green comfort url.

You must also enable protection against CSRF attacks. Use an anti-fake token.

In addition, you must use the PRG template (Post, Redirect, Get) to ensure that credit card numbers are not sent twice. After posting, don't just visualize another view, send a redirect so that their browser makes a GET against a different URL - perhaps on the confirmation page.

You will come across several specific ASP.NET MVC things:

• If you have http pages and some https pages, how will you encode links to https pages from http pages. You can hardcode them, but you have to hardcode the domain and protocol. You can't just use <% = Html.ActionLink (... see this SO question for more details.

• You need to make sure that you cannot hit your controllers when you are not using SSL. This will help you catch any errors and make sure no one is using http instead of https. See the [RequireSsl] attribute in the futures assembly. Here's a blog post about it from Adam Salvo

Answer 3

I have not read about ASP.net-MVC implementation. However, I believe that you have mixed up the terminology.

The MVC pattern will be evaluated on the server. [Therefore, there is no need to conduct security checks between components (if they are not displayed outside the program)]

I believe that many people get the impression that you are talking about HTTP POSTS after submitting the form (as opposed to HTTP GET)