- From: Marcos Cáceres <notifications@github.com>
- Date: Mon, 12 Feb 2018 20:00:32 -0800
- To: w3c/payment-request <payment-request@noreply.github.com>
- Cc: Subscribed <subscribed@noreply.github.com>
Received on Tuesday, 13 February 2018 04:02:12 UTC
marcoscaceres commented on this pull request. > + <li>A <a>top-level browsing context</a> need to explicitly grant an + <a>iframe</a> the ability to access the <a>PaymentRequest</a> + interface via the <a>allowpaymentrequest</a> attribute. This prevents + embedded third-party content from accessing the interfaces of the + <cite>Payment Request API</cite> without the <a>top-level browsing + context</a>'s permission. + </li> + <li>In the definition of <a>canMakePayment()</a> the Working Group + seeks a balance between user experience and date protection. As + defined, <a>canMakePayment()</a> provides the party that calls the + API with information about the user's environment. To reduce the + potential for abuse, implementers plan a number of mitigations, + including rate-limiting <a>canMakePayment()</a> calls from the same + origin. + </li> + <li>A user agent can limit matching (in <a>show()</a> and As above... I'm not entirely sure we adequately solved this or are mitigating attacks adequately yet. -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub: https://github.com/w3c/payment-request/pull/683#pullrequestreview-96020208
Received on Tuesday, 13 February 2018 04:02:12 UTC