Re: [w3c/browser-payment-api] Clarify use of API in (or not in) Secure Contexts (#501)

> On 4 Apr 2017, at 1:43 am, ianbjacobs <notifications@github.com> wrote:
> 
> My understanding is that the API is to be used in Secure Contexts. I note that:
> 
> SecureContext is optional on PaymentRequest constructor

You've misread the IDL. There is no such thing as optional SecureContext 😊

> Where SecureContext appears elsewhere in the spec it is not optional
> There is no clear statement in the prose about calling the API in a SecureContext

That would be redundant. Thought the link to the definition is currently broken (ReSpec bug, will fix)

> For iframes, the allowpaymentrequest attribute is non-normative.
It's normative in HTML. 

> It seems to me we need in the spec at least strong guidance about calling the API from a SecureContext, if not something normative.
> 

We already have all of the above, I assure you. This can be closed. 
> Ian
> 
> —
> You are receiving this because you are subscribed to this thread.
> Reply to this email directly, view it on GitHub, or mute the thread.
> 


-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/browser-payment-api/issues/501#issuecomment-291187455