Re: [w3c/browser-payment-api] The origin restrictions in the PaymentRequest are not nearly strong enough (#332)

> Why does that seem odd?

Because it allows B to trigger payment requests from A by when A might not expect it to.

Note that the proposed feature policy API has exactly the semantics I'm talking about: if a document doesn't have permission to do something, neither do any of its descendants.  And I believe that having the payment permissions model be describable by feature policy is an explicit goal.   So if it can't be, one or the other is wrong and needs to change.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/browser-payment-api/issues/332#issuecomment-264112758