Re: [w3c/payment-request] Editorial: use new user activation model (#885)

marcoscaceres commented on this pull request.



> @@ -956,11 +956,13 @@ <h2>
           follows:
         </p>
         <ol class="algorithm">
+          <li>Let |window:Window| be the [=relevant global object=] of the
+          [=environment settings object/responsible document=].

Ok, Stripe depends on clicking within the iframe - so we are good there. 

![Screenshot 2019-12-11 12 48 17](https://user-images.githubusercontent.com/870154/70584222-84228580-1c14-11ea-8f2a-94ebd2afa14c.png)

> So the question for the spec editors is, do you want to allow clicking on the top-level Window to activate a PaymentRequest object that comes from a same-origin iframe? 

I don't think we do. The activated window should be the one where `request.show()` is called.

For the clarity of those watching at home:

```HTML 
  <button>pay</button>
  <iframe src="same-origin.html" hidden>
    <!-- this iframe won't activate the payment request. --> 
  </iframe> 
```

This will never ever work, which is fine:
```HTML
  <button>pay</button>
  <iframe allowpaymentrequest src="https://cross.origin/" hidden>
  </iframe>
```

This will work: 
```HTML
  <iframe src="same-origin.html">
    <!-- something in iframe is clicked/activated, payment request works --> 
  </iframe>
   <iframe allowpaymentrequest src="https://cross.origin/" hidden>
  </iframe>
``` 

> Personally I'd lean toward the more conservative option, but I'm unsure what folks have implemented, or what kind of workflows the PaymentRequest API hopes to support in this fashion.

I agree. Let's go with that...  or **this** 😂. 


-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/payment-request/pull/885#discussion_r356373106