3D Secure (SCA) flow is implemented and handled correctly

Skipping 3D Secure (SCA) challenge handling means your checkout silently fails for European customers (where SCA is legally mandated under PSD2) and for any card issuer that requires additional authentication. More critically, omitting the requires_action status check means your code can mark an order as paid after receiving the initial PaymentIntent — before the card issuer has actually authorized the charge. The result: inventory is decremented, fulfillment is triggered, and the customer receives their order, but the actual charge later fails when the 3DS challenge times out. PCI-DSS 4.0 Req 8.4 covers multi-factor authentication requirements; OWASP A07 (Identification and Authentication Failures) captures incomplete authentication flows.

Use stripe.confirmPayment() with redirect: 'if_required' and always inspect the returned paymentIntent.status before updating your order state.

// Client component — full SCA-aware confirmation
const { error, paymentIntent } = await stripe.confirmPayment({
  elements,
  confirmParams: {
    return_url: `${window.location.origin}/checkout/complete`,
  },
  redirect: 'if_required',
})

if (error) {
  setError(error.message ?? 'Payment failed')
} else if (paymentIntent?.status === 'succeeded') {
  await confirmOrder(paymentIntent.id)  // only now mark the order as paid
} else if (paymentIntent?.status === 'requires_action') {
  // User is being redirected for 3DS — confirmOrder happens after return_url redirect
}

Create PaymentIntents server-side with automatic_payment_methods: { enabled: true } so Stripe requests 3DS when the issuer requires it.