From bf05cc97d319557922931403ab0b01c2420b8245 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marcos=20C=C3=A1ceres?= Date: Wed, 7 Oct 2020 17:32:06 +1100 Subject: [PATCH] Add hasEnrolledInstrument() again Revert "Remove hasEnrolledInstrument() (#930)" This reverts commit f697360ed9a34fc6974117a66a6a653bf3f2ecd5. --- index.html | 91 +++++++++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 76 insertions(+), 15 deletions(-) diff --git a/index.html b/index.html index cf9ef5d7..bca0cf54 100644 --- a/index.html +++ b/index.html @@ -632,6 +632,8 @@

Promise<undefined> abort(); [NewObject] Promise<boolean> canMakePayment(); + [NewObject] + Promise<boolean> hasEnrolledInstrument(); readonly attribute DOMString id; readonly attribute PaymentAddress? shippingAddress; @@ -1365,7 +1367,7 @@

canMakePayment() method

-
+

The {{PaymentRequest/canMakePayment()}} method can be used by the developer to determine if the user agent has support for one @@ -1375,11 +1377,30 @@

A true result from {{PaymentRequest/canMakePayment()}} does not imply that the user has a provisioned instrument ready for payment. + For that, use {{PaymentRequest/hasEnrolledInstrument()}} instead.

The {{PaymentRequest/canMakePayment()}} method MUST run the can - make payment algorithm. + make payment algorithm with |checkForInstruments| set to false. +

+ +
+

+ hasEnrolledInstrument() method +

+

+ The {{PaymentRequest/hasEnrolledInstrument()}} method can be used by + the developer to determine if the user agent has support for + one of the desired payment methods and if a payment + handler has an instrument ready for payment. See + [[[#canmakepayment-protections]]]. +

+

+ The {{PaymentRequest/hasEnrolledInstrument()}} method MUST run the + can make payment algorithm with |checkForInstruments| set to + true.

@@ -3924,7 +3945,10 @@

The can make payment algorithm checks if the user agent supports making payment with the payment methods - with which the {{PaymentRequest}} was constructed. + with which the {{PaymentRequest}} was constructed. It takes a boolean + argument, |checkForInstruments|, that specifies whether the algorithm + checks for existence of enrolled instruments in addition to + supporting a payment method.

  1. Let |request:PaymentRequest| be the {{PaymentRequest}} object on @@ -3934,9 +3958,11 @@

    "[=state/created=]", then return a promise rejected with an {{"InvalidStateError"}} {{DOMException}}.

    2. -
  2. Optionally, at the top-level browsing - context's discretion, return a promise rejected with a - {{"NotAllowedError"}} {{DOMException}}. +
  3. + Optionally, at the top-level browsing context's discretion, + return a promise rejected with a {{"NotAllowedError"}} + {{DOMException}}.

    This allows user agents to apply heuristics to detect and prevent abuse of the calling method for fingerprinting purposes, such as @@ -3959,9 +3985,39 @@

  4. Let |identifier| be the first element in the |paymentMethod| tuple.
    5. -
  5. If the user agent has a payment handler that supports - handling payment requests for |identifier|, resolve - |hasHandlerPromise| with true and terminate this algorithm. +
  6. If |checkForInstruments| is false, and the user agent has a + payment handler that supports handling payment requests + for |identifier|, resolve |hasHandlerPromise| with true and + terminate this algorithm. +
    7. +
  7. If |checkForInstruments| is true: +
      +
    1. Let |data| be the result of JSON-parsing the second + element in the |paymentMethod| tuple. +
      2. +
    2. If required by the specification that defines the + |identifier|, then [=converted to an IDL value|convert=] + |data| to an IDL value. Otherwise, [=converted to an IDL + value|convert=] to {{object}}. +
      3. +
    3. Let |handlers| be a list of registered payment + handlers that are authorized and can handle payment + request for |identifier|. +
      4. +
    4. For each |handler| in |handlers|: +
        +
      1. Let |hasEnrolledInstrument| be the result of running + |handler|'s steps to check if a payment can be + made with |data|. +
        2. +
      2. If |hasEnrolledInstrument| is true, resolve + |hasHandlerPromise| with true and terminate this + algorithm. +
        3. +
      +
      5. +

@@ -4907,14 +4963,19 @@

canMakePayment() protections

- The {{PaymentRequest/canMakePayment()}} method provides feature - detection for different payment methods. It may become a - fingerprinting vector if in the future, a large number of payment - methods are available. purposes. User agents are expected to protect - the user from abuse of the method. For example, user agents can - reduce user fingerprinting by: + The {{PaymentRequest/canMakePayment()}} and + {{PaymentRequest/hasEnrolledInstrument()}} methods have the potential + to expose user information that could be abused for fingerprinting + purposes. User agents are expected to protect the user from abuse of + the method. For example, user agents can reduce user fingerprinting + by:

    +
  • Allowing the user to configure the user agent to turn off + {{PaymentRequest/canMakePayment()}} and + {{PaymentRequest/hasEnrolledInstrument()}}, which would return a + promise rejected with a {{"NotAllowedError"}} {{DOMException}}. +
  • Rate-limiting the frequency of calls with different parameters.