1318988 - Implement `allowPaymentRequest` on iframe

Status: RESOLVED FIXED

(Core :: DOM: Web Payments, defect, P3)

Description

[Marcos Caceres [:marcosc]]

Controls if an iframe can access the PaymentRequest API.

Comment 1

[Hsin-Yi Tsai (she/her) | away [:hsinyi]]

Mapping the Trello_P1 priority to bugzilla P3.

Comment 2

[Simon Pieters [:zcorpan]]

On the spec side:

* When a document is initialized (https://html.spec.whatwg.org/#creating-a-new-browsing-context and https://html.spec.whatwg.org/#initialise-the-document-object ), https://html.spec.whatwg.org/#set-the-allow*-flags is run, which can set "allowpaymentrequest flag" and "allowusemedia flag" on Document.
* PaymentRequest constructor calls https://html.spec.whatwg.org/#allowed-to-use : https://github.com/w3c/browser-payment-api/pull/383
* getUserMedia also call allowed to use: https://github.com/w3c/mediacapture-main/pull/427

Relevant whatwg/html PRs:

https://github.com/whatwg/html/pull/2195
https://github.com/whatwg/html/pull/2217

Relevant w3c/web-platform-tests PRs:

https://github.com/w3c/web-platform-tests/pull/4369
https://github.com/w3c/web-platform-tests/pull/4615

I will write more tests for same origin-domain; see https://github.com/w3c/web-platform-tests/issues/4526

Comment 3

[Ben Tian (inactive)]

Bug 1318988 has added 'allowPaymentRequest' on iframe, but permission check in PaymentRequest constructor is still required.

Comment 4

[Ben Tian (inactive)]

(In reply to Ben Tian [:btian] from comment #3)
> Bug 1318988 has added 'allowPaymentRequest' on iframe, but permission check
> in PaymentRequest constructor is still required.

Should be bug 1331899.

Comment 5

[Alphan Chen [:alchen]]

Attachment: WIP patch

We can pass a few web-platform-test by this patch.
In this patch, I also add a mochitest.

Comment 6

[Alphan Chen [:alchen]]

Attachment: Implement allowPaymentRequest on iframe

With this patch, We can pass the following web-platform-tests.

https://w3c-test.org/payment-request/allowpaymentrequest/
 -> active-document-cross-origin.https.sub.html
 -> active-document-same-origin.https.html
 -> allowpaymentrequest-attribute-cross-origin-bc-containers.https.html
 -> allowpaymentrequest-attribute-same-origin-bc-containers.https.html
 -> no-attribute-cross-origin-bc-containers.https.html
 -> no-attribute-same-origin-bc-containers.https.html
 -> basic.https.html

Comment 7

[Andrea Marchesini [:baku]]

Comment on attachment 8886064 [details] [diff] [review]
Implement allowPaymentRequest on iframe

Review of attachment 8886064 [details] [diff] [review]:
-----------------------------------------------------------------

::: dom/payments/PaymentRequest.cpp
@@ +238,5 @@
> +  // If the node has the same origin as the parent node, the feature is allowed-to-use.
> +  // Otherwise, only allow-to-use this feature when the browsing context container is
> +  // an iframe with "allowpaymentrequest" attribute.
> +  nsCOMPtr<nsIDocument> doc = window->GetExtantDoc();
> +  nsINode* node = static_cast<nsINode*>(doc);

node can be null here. In this case return NS_ERROR_UNEXPECTED.

Comment 8

[Alphan Chen [:alchen]]

Attachment: Implement allowPaymentRequest on iframe. r=baku

https://treeherder.mozilla.org/#/jobs?repo=try&revision=9b39b0685d800b2a66375d3a3869b6b90057f024

Comment 9

[Alphan Chen [:alchen]]

Attachment: Implement allowPaymentRequest on iframe. r=baku

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/2911ec8bebec
Implement allowPaymentRequest on iframe. r=baku

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/2911ec8bebec

Comment 12

[Chris Mills [:cmills]]

Usually we don't mark features as available in iframes; we are more likely to mark a feature if it is explicitly not available in an iframe.

However, I appreciate that this feature's iframe availability is rather more critical than most (3rd party checkout apps, etc.), so I've put a note here about it:

https://developer.mozilla.org/en-US/docs/Web/API/Payment_Request_API#Payment_Request_Concepts_and_Usage

Do you think anything more is needed?

Comment 13

[Alphan Chen [:alchen]]

(In reply to Chris Mills (Mozilla, MDN editor) [:cmills] from comment #12)
> Usually we don't mark features as available in iframes; we are more likely
> to mark a feature if it is explicitly not available in an iframe.
> 
> However, I appreciate that this feature's iframe availability is rather more
> critical than most (3rd party checkout apps, etc.), so I've put a note here
> about it:
> 
> https://developer.mozilla.org/en-US/docs/Web/API/
> Payment_Request_API#Payment_Request_Concepts_and_Usage
> 
> Do you think anything more is needed?

I think you should add the note as the link below.
It is more accurate.
https://www.w3.org/TR/payment-request/#paymentrequest-and-iframe-elements

Thanks for your help.

Comment 14

[Chris Mills [:cmills]]

(In reply to Alphan Chen [:alchen] from comment #13)
> (In reply to Chris Mills (Mozilla, MDN editor) [:cmills] from comment #12)
> > Usually we don't mark features as available in iframes; we are more likely
> > to mark a feature if it is explicitly not available in an iframe.
> > 
> > However, I appreciate that this feature's iframe availability is rather more
> > critical than most (3rd party checkout apps, etc.), so I've put a note here
> > about it:
> > 
> > https://developer.mozilla.org/en-US/docs/Web/API/
> > Payment_Request_API#Payment_Request_Concepts_and_Usage
> > 
> > Do you think anything more is needed?
> 
> I think you should add the note as the link below.
> It is more accurate.
> https://www.w3.org/TR/payment-request/#paymentrequest-and-iframe-elements
> 
> Thanks for your help.

Ah, cool, thanks for the pointer.

I've updated my note so it is accurate, and I've also added an entry to the <iframe> page to explain the allowpaymentrequest attribute.

The equivalent DOM property is already documented:

https://developer.mozilla.org/en-US/docs/Web/API/HTMLIFrameElement

Comment 15

[Alphan Chen [:alchen]]

(In reply to Chris Mills (Mozilla, MDN editor) [:cmills] from comment #14)
> 
> I've updated my note so it is accurate, and I've also added an entry to the
> <iframe> page to explain the allowpaymentrequest attribute.
> 
> The equivalent DOM property is already documented:
> 
> https://developer.mozilla.org/en-US/docs/Web/API/HTMLIFrameElement

There are some updates about this attribute.

[Current Definition]
To indicate that a "cross-origin" iframe is allowed to invoke the payment request API, the allowpaymentrequest attribute can be specified on the iframe element. 


The keyword is "cross-origin". 
If the iframe has the same origin, we don't need 'allowpaymentrequest' attribute to use the payment request API.
So we still need some refinement here.
Thanks.

Comment 16

[Chris Mills [:cmills]]

(In reply to Alphan Chen [:alchen] from comment #15)
> (In reply to Chris Mills (Mozilla, MDN editor) [:cmills] from comment #14)
> > 
> > I've updated my note so it is accurate, and I've also added an entry to the
> > <iframe> page to explain the allowpaymentrequest attribute.
> > 
> > The equivalent DOM property is already documented:
> > 
> > https://developer.mozilla.org/en-US/docs/Web/API/HTMLIFrameElement
> 
> There are some updates about this attribute.
> 
> [Current Definition]
> To indicate that a "cross-origin" iframe is allowed to invoke the payment
> request API, the allowpaymentrequest attribute can be specified on the
> iframe element. 
> 
> 
> The keyword is "cross-origin". 
> If the iframe has the same origin, we don't need 'allowpaymentrequest'
> attribute to use the payment request API.
> So we still need some refinement here.
> Thanks.

Ah, I missed that detail - thanks for pointing this out.

I've made sure the cross-origin detail is made clear in all the relevant places:

* https://developer.mozilla.org/en-US/docs/Web/API/Payment_Request_API#Payment_Request_Concepts_and_Usage
* https://developer.mozilla.org/en-US/docs/Web/API/HTMLIFrameElement#Properties
* https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#Attributes