From cb008d7a347acbee8773493fb3d5c182ca01cfec Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marcos=20C=C3=A1ceres?= Date: Tue, 15 Sep 2020 18:35:51 +1000 Subject: [PATCH] Remove hasEnrolledInstrument() --- index.html | 91 +++++++++--------------------------------------------- 1 file changed, 15 insertions(+), 76 deletions(-) diff --git a/index.html b/index.html index bca0cf54..cf9ef5d7 100644 --- a/index.html +++ b/index.html @@ -632,8 +632,6 @@

Promise<undefined> abort(); [NewObject] Promise<boolean> canMakePayment(); - [NewObject] - Promise<boolean> hasEnrolledInstrument(); readonly attribute DOMString id; readonly attribute PaymentAddress? shippingAddress; @@ -1367,7 +1365,7 @@

canMakePayment() method

-
+

The {{PaymentRequest/canMakePayment()}} method can be used by the developer to determine if the user agent has support for one @@ -1377,30 +1375,11 @@

A true result from {{PaymentRequest/canMakePayment()}} does not imply that the user has a provisioned instrument ready for payment. - For that, use {{PaymentRequest/hasEnrolledInstrument()}} instead.

The {{PaymentRequest/canMakePayment()}} method MUST run the can - make payment algorithm with |checkForInstruments| set to false. -

- -
-

- hasEnrolledInstrument() method -

-

- The {{PaymentRequest/hasEnrolledInstrument()}} method can be used by - the developer to determine if the user agent has support for - one of the desired payment methods and if a payment - handler has an instrument ready for payment. See - [[[#canmakepayment-protections]]]. -

-

- The {{PaymentRequest/hasEnrolledInstrument()}} method MUST run the - can make payment algorithm with |checkForInstruments| set to - true. + make payment algorithm.

@@ -3945,10 +3924,7 @@

The can make payment algorithm checks if the user agent supports making payment with the payment methods - with which the {{PaymentRequest}} was constructed. It takes a boolean - argument, |checkForInstruments|, that specifies whether the algorithm - checks for existence of enrolled instruments in addition to - supporting a payment method. + with which the {{PaymentRequest}} was constructed.

  1. Let |request:PaymentRequest| be the {{PaymentRequest}} object on @@ -3958,11 +3934,9 @@

    "[=state/created=]", then return a promise rejected with an {{"InvalidStateError"}} {{DOMException}}.

    2. -
  2. - Optionally, at the top-level browsing context's discretion, - return a promise rejected with a {{"NotAllowedError"}} - {{DOMException}}. +
  3. Optionally, at the top-level browsing + context's discretion, return a promise rejected with a + {{"NotAllowedError"}} {{DOMException}}.

    This allows user agents to apply heuristics to detect and prevent abuse of the calling method for fingerprinting purposes, such as @@ -3985,39 +3959,9 @@

  4. Let |identifier| be the first element in the |paymentMethod| tuple.
    5. -
  5. If |checkForInstruments| is false, and the user agent has a - payment handler that supports handling payment requests - for |identifier|, resolve |hasHandlerPromise| with true and - terminate this algorithm. -
    6. -
  6. If |checkForInstruments| is true: -
      -
    1. Let |data| be the result of JSON-parsing the second - element in the |paymentMethod| tuple. -
      2. -
    2. If required by the specification that defines the - |identifier|, then [=converted to an IDL value|convert=] - |data| to an IDL value. Otherwise, [=converted to an IDL - value|convert=] to {{object}}. -
      3. -
    3. Let |handlers| be a list of registered payment - handlers that are authorized and can handle payment - request for |identifier|. -
      4. -
    4. For each |handler| in |handlers|: -
        -
      1. Let |hasEnrolledInstrument| be the result of running - |handler|'s steps to check if a payment can be - made with |data|. -
        2. -
      2. If |hasEnrolledInstrument| is true, resolve - |hasHandlerPromise| with true and terminate this - algorithm. -
        3. -
      -
      5. -
    +
  7. If the user agent has a payment handler that supports + handling payment requests for |identifier|, resolve + |hasHandlerPromise| with true and terminate this algorithm.

@@ -4963,19 +4907,14 @@

canMakePayment() protections

- The {{PaymentRequest/canMakePayment()}} and - {{PaymentRequest/hasEnrolledInstrument()}} methods have the potential - to expose user information that could be abused for fingerprinting - purposes. User agents are expected to protect the user from abuse of - the method. For example, user agents can reduce user fingerprinting - by: + The {{PaymentRequest/canMakePayment()}} method provides feature + detection for different payment methods. It may become a + fingerprinting vector if in the future, a large number of payment + methods are available. purposes. User agents are expected to protect + the user from abuse of the method. For example, user agents can + reduce user fingerprinting by:

    -
  • Allowing the user to configure the user agent to turn off - {{PaymentRequest/canMakePayment()}} and - {{PaymentRequest/hasEnrolledInstrument()}}, which would return a - promise rejected with a {{"NotAllowedError"}} {{DOMException}}. -
  • Rate-limiting the frequency of calls with different parameters.