Re: [w3c/browser-payment-api] Should PaymentResponse include totalAmount and if so must it be one of the supplied totals (#215) from Manu Sporny on 2016-06-16 (public-webpayments-specs@w3.org from June 2016)

From: Manu Sporny <notifications@github.com>
Date: Thu, 16 Jun 2016 08:46:33 -0700
To: w3c/browser-payment-api <browser-payment-api@noreply.github.com>
Cc:
Message-ID: <w3c/browser-payment-api/issues/215/226526853@github.com>

> So merchants should check the response.

How do merchants know the response wasn't tampered with in transit? That is, if we're putting the total in there so the merchants can feel safe that the amount requested was the amount paid (and we have no MiTM protection on totalAmount), doesn't that defeat the purpose of including the value in the response?

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/browser-payment-api/issues/215#issuecomment-226526853

Received on Thursday, 16 June 2016 15:47:14 UTC