Re: [w3c/browser-payment-api] Should the Payment Request API only be available in a top-level browsing context? (#2)

I finally cornered one of our security people on this. He points out that the kind of thing we're trying to do is congruent with the [delegated permissions work currently underway](https://noncombatant.github.io/permission-delegation-api/).

I propose we adopt this approach, which allows both declarative and imperative delegation of extra permissions to iframes.

Declaratively:
```html
<iframe src="..." permissions="payment">
```

Imperatively:
```javascript
var iframe = document.getElementById('payment_frame');
navigator.permissions.delegate({embedee: iframe, name: 'geolocation'}).then(
  function() {
    // Delegation succeeded.
  }).catch(function() {
    // Delegation failed.
  });
```

In particular, we beleive that using the ```sandbox``` attribute for this purpose, [as was discussed last month](https://www.w3.org/2016/05/12-wpwg-minutes.html#item08), is the wrong tool for this job, as it removes capabilities, rather than adding them.

---
You are receiving this because you commented.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/browser-payment-api/issues/2#issuecomment-228463359