I developed a Stripe cloaking system, need feedback

lehehroi said:

So I just wanted feedback on if there was any possible way stripe could bust my system, below is the process:

I have Website A (Blackhat) and Website B (Whitehat).

1) User clicks payment button on A
2) Website A backend makes an API call to Website B's API
3) Website B's API creates the Stripe hosted checkout
4) After successful/canceled payment, user is redirected to Website B's API again, which only then sends the hser back to Website A

I included no-referrer in Website Bs header as well. So based on my system above, is there any way that Stripe can tel of Website A's involvement?

Click to expand...

GlobalProxy4g said:

looks clean on the surface but stripe can still track things through user fingerprinting like ip user agent canvas webgl if too many users go through the same ips or a similar pattern they can flag it also make sure website a and b have different ips like use 4g 5g mobile proxies to avoid an obvious connection between them

Click to expand...

GlobalProxy4g said:

looks clean on the surface but stripe can still track things through user fingerprinting like ip user agent canvas webgl if too many users go through the same ips or a similar pattern they can flag it also make sure website a and b have different ips like use 4g 5g mobile proxies to avoid an obvious connection between them

Click to expand...

GlobalProxy4g said:

yeah e2e is solid but even with full separation there are still invisible traces that can link both sites like browsing patterns, api response times, fingerprinting etc so you also need to randomize all that otherwise it's just an open door for detection

Click to expand...

1. Payment Patterns – Unusual transactions or high-risk services.
2. User Data – IPs, devices, and user behavior tracking.
3. Network Analysis – Even with no-referrer, traffic patterns can expose links.
4. Chargebacks – Users mentioning Website A in disputes.
5. API Monitoring – If Website B acts only as a pass-through.