Re: [w3c/payment-request] Deprecate allowpaymentrequest attribute (#928)

@danyao requested changes on this pull request.

Sorry for missing this bit of detail yesterday. I think we need to recommend `allow="payment *"` instead of `allow="payment"` as the replacement for `allowpaymentrequest`.

> @@ -594,6 +597,23 @@ <h3>
           doPaymentRequest();
         </pre>
       </section>
+      <section>
+        <h2>
+          Using with cross-origin iframes
+        </h2>
+        <p>
+          To indicate that a cross-origin [^iframe^] is allowed to invoke the
+          payment request API, the [^iframe/allow^] attribute along with the
+          "payment" keyword can be specified on the [^iframe^] element.
+        </p>
+        <pre class="example html" title=
+        "Using Payment Request API with cross-origin iframes">
+            &lt;iframe
+              src="https://cross-origing.example"
+              allow="payment"&gt;

It was pointed out to me on https://bugs.chromium.org/p/chromium/issues/detail?id=1127988#c2 that the equivalent of `allowpaymentrequest` is actually `allow="payment *"`.

If I'm reading the [Permissions Policy spec][1] correctly, `allow="payment"` (without the *) only enables Payment Request API in same-origin iframes. @clelland to confirm.

[1]: https://w3c.github.io/webappsec-permissions-policy/#allowlists

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/payment-request/pull/928#pullrequestreview-489984396