[w3c/browser-payment-api] Clarify use of API in (or not in) Secure Contexts (#501)

My understanding is that the API is to be used in Secure Contexts. I note that:

* SecureContext is optional on PaymentRequest constructor
* Where SecureContext appears elsewhere in the spec it is not optional
* There is no clear statement in the prose about calling the API in a SecureContext
* For iframes, the allowpaymentrequest attribute is non-normative.

It seems to me we need in the spec at least strong guidance about calling the API from a SecureContext, if not something normative. 

Ian

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/browser-payment-api/issues/501