From f95851ed1662c9fc454bf48991c43174dbf57ed7 Mon Sep 17 00:00:00 2001 From: Christoph Schwering Date: Tue, 30 May 2023 03:03:26 +0200 Subject: [PATCH] Extend note and example This commit extends the example to explain how and why payment forms today use cross-origin iframes. It also extends the note to explain why a user agent might ignore share-autofill or fill in controls even when shared-autofil is disabled. --- source | 69 ++++++++++++++++++++++++++++++++++------------------------ 1 file changed, 40 insertions(+), 29 deletions(-) diff --git a/source b/source index 7b6486ec12c..d24886dccf0 100644 --- a/source +++ b/source @@ -44575,7 +44575,7 @@ interface HTMLTableCellElement : HTMLElement {

User agents are not limited to the form controls of a specific form - in their automatic filling. In particular, they might consider fields from different documents + in their automatic filling. In particular, they can consider fields from different documents as explained in the eligible for autofill section.

@@ -55578,13 +55578,13 @@ form.method === input; // => true
Autofill
-

Some user agents have features for helping users fill forms in, for example prefilling the +

Some user agents have features for helping users fill in forms, for example prefilling the user's address based on earlier user input. They may autofill either an individual form control or multiple controls at once.

-

A user agent might offer the user to automatically fill their address in a form like the - following.

+

A user agent might offer the user to automatically fill their address in the following + form.

<form method=post action="https://pizza.exampe.com/order.cgi">
  <label> Name:        <input></textarea> </label>
@@ -55594,11 +55594,11 @@ form.method === input; // => true
<label> Country: <select>...</select> </label> </form> -

For example, the user agent could suggest values to fill when the user focuses or types in +

For example, the user agent could suggest values to fill when the user focuses or types into one of the controls.

-

The user agent may fill multiple controls at once even if they have different +

The user agent may fill in multiple controls at once even if they have different form owners, root nodes, or even node documents. However, the user agent should only fill in controls that are eligible for autofill.

@@ -55607,7 +55607,7 @@ form.method === input; // => true

A form control control is eligible for autofill if control's node document document is a fully active descendant of a top-level - traversible with user attention and one of the following is true:

+ traversable with user attention and one of the following is true:

-

Consider the following page https://pizza.example.com/:

+

In this example, the pizza store has outsourced payment processing to a service provider. To + comply with the payment industry standard PCI-DSS, certain form controls are hosted + in cross-origin iframes. Visually, these form controls integrate seamlessly with the pizza + store's look and feel; the user is not made aware of the controls' origins. +

+ +

The checkout form on https://pizza.example.com/ has enabled + shared-autofill as a hint to the user agent to fill + in the entire payment form.

<form method=post>
  <p> Cardholder name:    <input>
@@ -55630,7 +55638,7 @@ form.method === input; // => true
</form> <iframe src="https://ads.example.com/ad.html"></iframe> -

Let number.html and cvc.html each contain an +

number.html and cvc.html each contain an input:

<!doctype html>
@@ -55639,34 +55647,34 @@ form.method === input; // => true
<input> </html> -

Suppose the user starts filling the cardholder name and the user agent offers to fill the +

Suppose the user starts typing the cardholder name and the user agent offers to fill in the entire credit card form. The cardholder name and expiration date controls are eligible by means of their origin, and the controls in number.html and cvc.html are eligible due to the shared-autofill feature. - By contrast, none of the controls in ad.html are eligible because of the - distinct origins and the absent shared-autofill - feature; this prevents leaking information to the ad server.

+ None of the controls in ad.html is eligible because of the distinct + origins and the absent shared-autofill feature; + this prevents leaking information to the ad server.

-

The user agent does not have to fill in all eligible form controls, and it can fill - in form controls that are not eligible. In particular, it can ignore - shared-autofill depending on the type of data - to be filled and the relationships of the controls' node navigables. For example:

+

Whether a form control is eligible for autofill by means of + shared-autofill might be beyond control of the + focused document: policy-controlled + features can be enabled or disabled by a parent document in its children, but not vice + versa. This reflects how form controls in cross-origin iframes are commonly seamlessly integrated + with the top-level document. The user agent might ignore + shared-autofill in documents that are not + descendants of the focused document, perhaps depending on the value that would be filled.

- +

The user agent might generally ignore + shared-autofill in cross-origin frames + when filling in usernames and passwords since these credentials might be associated to a specific + origin.

+ +

On the other hand, the user agent might fill in cross-origin form controls in the absence of + shared-autofill if it thinks this is the user's + intention, for example, because the user consented.

@@ -133898,6 +133906,9 @@ INSERT INTERFACES HERE
[PAYMENTREQUEST]
Payment Request API, M. Cáceres, D. Wang, R. Solomakhin, I. Jacobs. W3C.
+
[PCI-DSS]
+
(Non-normative) PCI Data Security Standard — Information Supplement: Best Practices for Securing E-commerce. Payment Card Industry Security Standards Council.
+
[PDF]
(Non-normative) Document management — Portable document format — Part 1: PDF. ISO.