I have a GAE application that is mapped to a subdomain on a custom domain. As the result, I have to use HTTP for everything that’s being served under that subdomain. This is marginally unsecure, but is acceptable for most of the application except paymets/subscription part.
Right now, I’m leaning towards using Stripe for processing and building a custom form to handle the signup process. It seems that the only way to get HTTPS is to redirect the user explicitly to https://.appspot.com/ and then send them back to the custom subdomain. I also considered a pop-up.
Are there any other ways to implement secure payments page on GAE?
For now, redirecting to https://your-app-id.appspot.com is the only way to get SSL. However, SSL for custom domains is in testing now, so in the future you will be able to update to that (you could also sign up for the test group and maybe get accepted). This will be an additional cost, though, whereas the SSL on appspot.com is free.