Re: [w3c/browser-payment-api] Should user agent validate currency? (#490)

Be aware that using language features related to currency is a dangerous trap. It's like trying to use domain or email parsing features that have a hardcoded list of TLDs.

Sure, it's convenient for the poor designer that has to figure out the UI but it will likely come back to bite you later.

Forcing a format like /^[a-z]{3}$/i is also dangerous because it will encourage squatting on codes that may become legitimate ISO 4217 codes in future.

I recommend @marcoscaceres approach for the default currency system (ISO4217) but would encourage some sane limits for other systems too (maybe just a max length and limited charset?)

**Use case:** Buy an upgrade on delta.com using the currency SKYMILES

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/browser-payment-api/issues/490#issuecomment-291299566

Received on Monday, 3 April 2017 22:54:33 UTC