Re: [w3c/browser-payment-api] The origin restrictions in the PaymentRequest are not nearly strong enough (#332)

> Because it allows B to trigger payment requests from A by when A might not expect it to.

I disagree. Both contexts from origin A (the top-level and innermost contexts) can trigger payment requests but the other context (with origin B) cannot.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/browser-payment-api/issues/332#issuecomment-264413919