Is paypment request gated behind https?

[jdalton]

Is it spec'ed whether the payment request API works on pages running on the file:///?
Example: A dev opens a page locally (not on localhost) to test the API.

[romandev]

PaymentRequest is only allowed in SecureContext.
https://w3c.github.io/payment-request/#paymentrequest-interface

[marcoscaceres]

@jdalton, as @romandev stated, the API is only exposed in "SecureContext". You can read about what that means (but effectively, yes - only HTTPS, no file://): https://heycam.github.io/webidl/#SecureContext

[jdalton]

Thanks!

[rsolomakhin]

FYI, Chrome considers the following to be secure contexts, which allow PaymentRequest per spec:

• https://
• file://
• localhost
  • http://localhost
  • http://127.0.0.1
  • http://[::1]

One interesting edge case is invalid HTTPS certificate. In this case, Chrome shows an interstitial alerting the user to dangers of proceeding. If the user elects to proceed, the context is considered secure, so Chrome allows PaymentRequest to match the spec, but the API is neutered:

1. .canMakePayment() always returns false.
2. .show() always rejects with NotSupportedError.
3. The UI is never shown.

You can observe this behavior on https://self-signed.badssl.com/input/web-payment/ for example.

[ianbjacobs]

Hi @marcoscaceres and @rsolomakhin,

Did you answer the question differently from one another? It seems Chrome would allow use of PR API with "file:" but @marcoscaceres seems to suggest Firefox would not.

Am I reading that correctly?

Whatever the outcome, I'd like to add to the FAQ [1].

Ian

[1] https://github.com/w3c/payment-request-info/wiki/FAQ/

[rsolomakhin]

@ianbjacobs: The spec allows PaymentRequest in "secure context," which includes file:// in Chrome, but not in Firefox, from what I understand. This is a good item to add to the FAQ.

[ianbjacobs]

MDN documentation [1] says: "Locally delivered files such as http://localhost and file:// paths are considered to have been delivered securely."

Ian

[1] https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts