Add "Validate Methods Algorithm"

[rsolomakhin]

Validate the payment method identifiers that a service worker can use
depending on their validity and the corresponding payment method
manifests.

[rsolomakhin]

I've created this pull request to solicit comments on the outlined approach for using Payment Method Identifier and Payment Method Manifest specs in here. Please let me know what you think. I will be getting some implementation experience in the coming weeks and will report back.

[ianbjacobs]

Thanks @rsolomakhin, this proposal relates to my security question:
w3c/payment-method-manifest#11

Ian

[rsolomakhin]

@ianbjacobs wrote:

The browser implements Payment Request API but not Payment Method Manifest

I've addressed this issue in this pull request by checking whether Payment Method Manifest spec is implemented. In this case, payment handlers can use all standardized payment method identifiers, but as for URL-based payment method identifiers, the origin of the identifier must be equal to the origin of the service worker registration scope URL.

[rsolomakhin]

@ianbjacobs wrote:

The browser implements Payment Method Manifest, but there is a failure of some
sort (related to fetching, parsing, or ingesting the manifest file).

I've explicitly added a check for such failure.

[marcoscaceres]

Please be sure to provide WPT tests along with all PRs.

[rsolomakhin]

Looks like PMM spec already has this algorithm. What we need to say in the PH spec is that
when the browser matches payment method manifest origin against the payment app origin, it uses the payment handler scope URL origin.