Re: [w3c/payment-request] Add privacy protenction to MerchantValidationEvent's validationURL (#850)

ianbjacobs requested changes on this pull request.

Hi @marcoscaceres 

I agree with the sentiment, but two things make me uncomfortable:

 * Imposing a normative requirement on payment handlers in this specification.
 * It would probably be ok for the URL to include some information about a person for an authorized server; we don't want that information to be visible to unauthorized parties.

Proposed:

   "It is important that the <a>validationURL</a> in a <a>MerchantValidationEvent</a>
   does not expose personally identifying information to unauthorized parties."

I am avoiding creating a normative requirement, but do want to stress the importance.



-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/payment-request/pull/850#pullrequestreview-213394972