I believe this issue ignores the fact that most payment apps will not be registered as part of the checkout flow. The `PaymentApp.register()` function will be called by payment app publishers and we have said we want to enforce origin based security which implies the user is currently in a context that has the same origin as the app publisher and also the same origin as the app invocation URL. This context is highly likely to be the user's online banking website or the website of their chosen wallet provider. It could be the merchant's website but only in the case where the merchant has a payment app. --- You are receiving this because you commented. Reply to this email directly or view it on GitHub: https://github.com/w3c/webpayments-payment-apps-api/issues/8#issuecomment-235868898
Received on Thursday, 28 July 2016 11:26:59 UTC