Define Content Security Policy for allowed Payment Pointer origins

[adrianhopebailie]

From #14 (comment) originally posted by @justmoon

... make Web Monetization part of the Content Security Policy in the future. For instance, my CSP could determine which origins I allow for payment pointers:

Content-Security-Policy: default-src 'none'; monetization-src mywallet.com

Which would allow payment pointers starting with $mywallet.com.

[Malvoz]

Consider that someone, somewhere made the decision not to have a CSP directive govern the Payment Request API, but instead as a policy-controlled feature named payment. That is why I initially proposed a Feature-Policy directive for web monetization, to align with that approach. See #28 (comment).

I don't think there's a need for a CSP directive if there is a FP feature...

[adrianhopebailie]

@Malvoz this is for a different purpose. This allows the site owner to define restrictions around the origins of Payment Pointers that are used.

Feature Policy would be for controlling which third-party contexts can be monetized.

Or am I misunderstanding?

[Malvoz]

A document can impose a Feature-Policy on itself, e.g. by sending along a Feature-Policy HTTP header, or potentially using a <meta http-equiv="Feature-Policy" content="..."> element. So in that regard FP works the same as CSP.

In other words Feature-Policy can be delegated both using an HTTP header (which controls the document itself and third-parties), and the allow attribute which only affects nested content (this granular control isn't possible with CSP).

[adrianhopebailie]

Right, but it feels like in this case we're using FP to allow (or not) monetization and CSP to specify which Payment Pointers are allowed.

[Malvoz]

That makes sense, these are 2 separate concerns. Sorry for the distraction.

[marcoscaceres]

I've added Permission Policy integration in #214, but it would make sense to also restrict the origins from which the setup JSON is sourced.

[marcoscaceres]

Noting, this would need to be added to the Fetch spec.... the WM spec could make note of it tho.

[marcoscaceres]

CSP is now defined in PR #193