Stripe payment links always return HTTP 200, even if the link does not exist

·1 views

A developer discovered that Stripe's hosted payment page at buy.stripe.com returns an identical HTTP 200 response and byte-for-byte the same HTML whether a payment link is live, deactivated, or entirely fabricated. This happens because the page is a JavaScript shell that resolves the URL slug client-side after the document loads, making server-side HTTP status checks meaningless. The only reliable way to verify a payment link is to use Stripe's API, specifically by listing payment links via /v1/payment_links and matching on the url field, since there is no direct lookup-by-slug endpoint. Beyond existence, the API also reveals whether a link is active, in live mode, and whether its price matches what is advertised in published materials. The author updated their release verification tooling to drop HTTP fetching entirely in favor of API-only resolution.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why a Screen-Aware Mac Assistant Needs More Than Just Screenshots

A screenshot alone cannot convey the meaning of controls, confirm whether an action succeeded, or define how much authority an AI assistant should hold on a Mac. A reliable screen-aware assistant must combine three data sources: macOS accessibility structure, visual context such as OCR, and interaction state tracking. Each source has known gaps, so the assistant must cross-reference all three and fail transparently when confidence is insufficient. The recommended action loop is observe, plan, seek approval when needed, act, and verify — advancing only when the expected screen state is confirmed. Privacy safeguards are equally critical, limiting data collection to the current task and avoiding permanent storage of unrelated screen history.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Idempotency Is Essential for Reliable and Safe API Design

Idempotency is a software design principle ensuring that repeating an operation multiple times produces the same result as executing it once. It is especially critical in web development, where unreliable networks can cause clients to retry requests, risking duplicate actions such as double-charging a customer. Developers implement idempotency using unique identifiers called idempotency keys, which allow servers to detect and safely ignore repeated requests by returning the cached result of the original operation. This approach is widely applied in payment gateways, database migrations, and email dispatch systems. By building idempotent APIs, engineers protect users and systems from the unpredictable consequences of network failures and accidental retries.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build a Device-Aware Beauty AR Controller That Respects Consent and Capability

A tutorial on DEV Community outlines how developers should approach GAN-powered beauty effects in video applications by treating them as optional, device-dependent capabilities rather than universal defaults. The guide argues that enabling all effects regardless of hardware leads to poor performance on lower-end devices, shifting the engineering burden onto users who can least afford it. It proposes an application-owned Beauty AR controller built with Node.js and TypeScript that separates consent, user preference, and device capability into three distinct decisions. The controller selects an effect profile based on measured device performance and automatically downgrades under sustained frame pressure, but refuses to auto-upgrade mid-session or act on stale callbacks. Tencent RTC's Beauty AR SDK serves as the integration platform, with the tutorial emphasizing that policy logic should live in the application layer, not inside renderer callbacks.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Cloudera Launches Anywhere Cloud Hybrid Platform for Enterprise AI Workloads

Cloudera announced its new Anywhere Cloud platform on August 19, designed to support data and AI workloads in a hybrid cloud environment. The platform aims to give enterprises cloud-native flexibility while allowing them to retain control over sensitive data and infrastructure. The launch addresses a growing challenge in enterprise AI adoption, where organizations often cannot migrate all workloads to a single public cloud. By combining on-premises systems with cloud capabilities, the platform targets companies that require a mixed architecture for production AI deployments.

0 comments Read more at DEV Community