I developed a Stripe cloaking system, need feedback

[lehehroi]

So I just wanted feedback on if there was any possible way stripe could bust my system, below is the process:

I have Website A (Blackhat) and Website B (Whitehat).

1) User clicks payment button on A
2) Website A backend makes an API call to Website B's API
3) Website B's API creates the Stripe hosted checkout
4) After successful/canceled payment, user is redirected to Website B's API again, which only then sends the hser back to Website A

I included no-referrer in Website Bs header as well. So based on my system above, is there any way that Stripe can tel of Website A's involvement?

 

[GlobalProxy4g]

So I just wanted feedback on if there was any possible way stripe could bust my system, below is the process:

I have Website A (Blackhat) and Website B (Whitehat).

1) User clicks payment button on A
2) Website A backend makes an API call to Website B's API
3) Website B's API creates the Stripe hosted checkout
4) After successful/canceled payment, user is redirected to Website B's API again, which only then sends the hser back to Website A

I included no-referrer in Website Bs header as well. So based on my system above, is there any way that Stripe can tel of Website A's involvement?

looks clean on the surface but stripe can still track things through user fingerprinting like ip user agent canvas webgl if too many users go through the same ips or a similar pattern they can flag it also make sure website a and b have different ips like use 4g 5g mobile proxies to avoid an obvious connection between them

 

[lehehroi]

looks clean on the surface but stripe can still track things through user fingerprinting like ip user agent canvas webgl if too many users go through the same ips or a similar pattern they can flag it also make sure website a and b have different ips like use 4g 5g mobile proxies to avoid an obvious connection between them

thanks for that, ill look that up

 

[oussamadev]

looks clean on the surface but stripe can still track things through user fingerprinting like ip user agent canvas webgl if too many users go through the same ips or a similar pattern they can flag it also make sure website a and b have different ips like use 4g 5g mobile proxies to avoid an obvious connection between them

do you have any further suggestions ?

 

[welax0x]

Website A and Website B should be fully isolated from each other in terms of session and user data. And when making the API call from Website A to Website B, include no identifiable metadata and make sure the redirect back to Website A after payment is clean, with no session or identifiable data from Website B. Also, each site’s payment flows shud be entirely independent, with no cross-site session persistence or overlap in user tracking.
The ultimate solution is to implement end-to-end encryption (E2EE) for the entire communication.

 

[GlobalProxy4g]

yeah e2e is solid but even with full separation there are still invisible traces that can link both sites like browsing patterns, api response times, fingerprinting etc so you also need to randomize all that otherwise it's just an open door for detection

 

[lehehroi]

yeah e2e is solid but even with full separation there are still invisible traces that can link both sites like browsing patterns, api response times, fingerprinting etc so you also need to randomize all that otherwise it's just an open door for detection

i see thanks for that, ill look into those. Thanks for all the help guys

 

[Mudasirseo]

Yes, Stripe can detect Website A through:

1. Payment Patterns – Unusual transactions or high-risk services.
2. User Data – IPs, devices, and user behavior tracking.
3. Network Analysis – Even with no-referrer, traffic patterns can expose links.
4. Chargebacks – Users mentioning Website A in disputes.
5. API Monitoring – If Website B acts only as a pass-through.

To reduce risk, mix in legitimate transactions, avoid sudden spikes, and separate hosting/IPs.