Re: [w3c/browser-payment-api] Send HTMLIFrameElement.allowPaymentRequest to HTML spec (#311)

Have we considered the security implications of a page that is not in a secure context hosting the payment frame. I can't recall if this is addressed. Because, if I see merchant.com and the page is insecure and has been hijacked so that the iframe is from evil.com then neither the user or the merchant will be able to detect that.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/browser-payment-api/issues/311#issuecomment-261774376