title: Stripe Portal Stripe Security concern
body: <p>I am working in the stripe portal into my website for customers to manage subscriptions.</p>
  <p>I use my own customer id to make a call to my own database to get the stripe customer ID to start the session for the stripe redirect. My own customer id is exposed to the user and I am concerned that if an attacker can guess my own customer ids they could gain access to a clients stripe account to change subscriptions.</p>
  <p>the HTML will contain the customer id &quot;entity_id&quot;</p>
  <p>the code is something along these lines
  JS</p>
  <pre><code>$(document).on(&quot;click&quot;, &quot;#phone&quot;, function (e) {
  
    var entity_id = $('#entity_id').val();
  
    $.ajax(
      {
        type: &quot;POST&quot;,
        url: &quot;include_new_gun_advert/stripe_redirect.php&quot;,
        data: { entity_id },
        dataType: 'json',
        beforeSend: function () {
  
        },
        success: function (data) {
          view_data = data;
          console.log(view_data);
  
          //$(&quot;#phone&quot;).text(view_data);
  
         ;
  
        }
      });
  });
  </code></pre>
  <p>PHP:</p>
  <pre><code>&lt;?php
  require_once('../vendor/autoload.php');
  include 'connection/pdo_conn.php';
  
  \Stripe\Stripe::setApiKey('MYKEY');
  
  if(isset($_POST['entity_id']) &amp;&amp; $_POST['entity_id'] !== '')
  {
  //Title 
  $entity_id = $_POST['entity_id'];
  
  try {
      $getStripeCustomerId = $connect-&gt;prepare(&quot;QUERY where entity_id = ? &quot;);
      $getStripeCustomerId-&gt;execute([$entity_id]);
      $setStripeCustomerId = $getStripeCustomerId-&gt;fetchAll();
  } catch (PDOException $e) {
      echo &quot;Connection failed: &quot; . $e-&gt;getMessage();
      $getStripeCustomerId = $e-&gt;getMessage();
  }
  
  
  
  
  // Authenticate your user.
  
  $session = \Stripe\BillingPortal\Session::create([
    'customer' =&gt; $setStripeCustomerId[0][0],
    'return_url' =&gt; 'https://example.com/account',
  ]);
  
  // Redirect to the customer portal.
  echo json_encode( $session-&gt;url);
  exit();
  
  }
  
  else {
    echo json_encode( 'account_payments.php');
  }
  </code></pre>
  <p>I'm I correct to be concerned? It seems very exposed or is there safe guards?</p>
  <p>Thanks,</p>
  <p>Richard</p>