> If the merchant doesn't want the user to be taken down an enrollment path:
>
> They can "poll" the API to see if the user is able to handle the request with their registered apps.
I'm wondering in this scenario what prevents the merchant from simply polling the API constantly with a differing list of registered apps, in an attempt to divulge the registered payment applications a user has. Would I be correct in assuming merchants couldn't invoke this polling until they called show?
---
You are receiving this because you commented.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/webpayments/issues/159#issuecomment-233213619