Re: [w3c/payment-request] Disable Payment Request API in CSP/iframe sandbox (#698)

Looking quickly, seems we would need to add it to:

 *[HTML Sandboxing](https://html.spec.whatwg.org/multipage/origin.html#sandboxing) 
 
And we would need something like this in the PaymentRequest constructor:

>  If the document object's active sandboxing flag set has the sandboxed payment request browsing context flag set, throw a `SecurityError` DOMException.

@domenic, does the above seem right? Or is there more to it? 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/payment-request/issues/698#issuecomment-377094255