The secure checkout at checkout.rsl-commerce.test. It is a separate application because
its security profile differs from the storefront's. It has less code, fewer dependencies and
stricter rules.
SANDBOX ONLY. NO REAL PAYMENTS ARE PROCESSED.
- Showing an authoritative checkout session, for example
checkout.rsl-commerce.test/session/chk_12345 - Displaying the values the server decided: products, quantities, discounts, tax, subtotal, total, currency and expiry
- Collecting payment details through Authorize.Net tokenization, so raw card data never reaches our servers
- Confirming the outcome and returning the customer to the storefront
- A strict Content Security Policy
- Prices or any other authoritative value. The backend computes them; checkout only displays them.
- Order and payment state. The backend owns both.
- Advertising trackers, session replay, non-essential analytics and unnecessary third-party scripts. None of these belongs here.
- backend. It owns the checkout session and records the payment.
- storefront. It sends customers here.
- design-system. Checkout takes only the components it needs.
- Authorize.Net sandbox. It tokenizes the payment details.
Run .githooks/setup once after cloning. It turns on the committed hooks, which use
git-secrets to refuse any commit
that contains a secret.
Planning. No code yet.