marcoscaceres commented on this pull request. > + </h2> + <p> + This specification includes a number of mechanisms to enhance the + security of the API: + </p> + <ul data-link-for="PaymentRequest"> + <li>Explicit user action is required to call <a>PaymentRquest</a>'s + <a>show()</a> method. This reduces content's ability to unexpectedly + cause a request for payment to be displayed to the end-user. + </li> + <li>Interfaces are <a data-cite= + "WEBIDL#dfn-available-only-in-secure-contexts">available only in a + secure context</a>, to reduce the possibly that credentials will be + acquired and transferrer through insecure communication protocols. + </li> + <li>A <a>top-level browsing context</a> need to explicitly grant an I think we might have a small security problems in the HTML Spec... it says to no expose the `PaymentRequest` interface, but doesn't say anything about the event interface, `PaymentResponse`, etc. There might not be many attacks one can do with those, but would rather them be out of the picture entirely. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/w3c/payment-request/pull/683#pullrequestreview-96019842
Received on Tuesday, 13 February 2018 03:57:59 UTC