Intent to experiment: Deprecate and remove merchant identity in "canmakepayment"

[Rouslan Solomakhin]

Contact emails

rou...@chromium.org

Specification

https://w3c.github.io/payment-handler/

Summary

This is an early heads up that we intend to remove the merchant origin and arbitrary data from the "canmakepayment" service worker event of the Payment Handler API. These are the event fields to be removed:

• topOrigin
• paymentReuqestOrigin
• methodData
• modifiers

The removal will be happening through the use of an origin trial at first, then a reverse origin trial, and finally removal.

Blink component

Blink>Payments

Motivation

The “canmakepayment” service worker event lets the merchant know whether the user has a card on file in an installed service-worker based payment app. It silently passes the merchants’ origin and arbitrary data to the service worker from the payment app origin. This cross-origin communication happens on new PaymentRequest() construction in JavaScript, does not require a user gesture, and does not show any user interface.

Alternatively, we have considered and dismissed the option to remove the “canmakepayment” event entirely and behave as if it always returns "true", because some payment app partners have indicated to us that's what they always do. However, the data that we have collected shows that the “canmakepayment” event returns "false" 1% to 6% of the time, depending on the platform.

TAG review status

Not applicable

Risks

Interoperability and Compatibility

Only Chrome has implemented the Payment Handler API.

Chrome is reaching out to the known partners that may be depending on these fields.

WebView application risks

The Payment Handler API requires the use of the PaymentRequest API. Neither API is available in WebView.

Is this feature fully tested by web-platform-tests?

Yes

Flag name

PaymentHandlerMerchantIdentity

Requires code in //chrome?

True

Estimated milestones

Origin trial: 108

Reverse origin trial: 111

Removal: 114

Link to entry on the Chrome Platform Status

https://chromestatus.com/feature/5190978431352832

This intent message was generated by Chrome Platform Status.

[Yoav Weiss]

So this intent is requesting to run the first OT M108-M110?

Any deprecation period you have in mind?

It might be better to send separate intents for the rest when their milestones get closer. 

--
You received this message because you are subscribed to the Google Groups "blink-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAMMzaWFz1UFWxgOs%2BECSdF2Bt8JpsBkGtv2wMnq2pemGMmD8Fw%40mail.gmail.com.

[Rouslan Solomakhin]

> So this intent is requesting to run the first OT M108-M110?

Correct.

> Any deprecation period you have in mind?

Good point. We should start by printing a warning message when these fields are accessed for a few milestones. M105--M107 would be good. Do I need to resend this as an intent to deprecate first?

[Yoav Weiss]

LGTM to run Origin Trial removal 108-110

On Wednesday, April 20, 2022 at 4:27:10 PM UTC+2 Rouslan Solomakhin wrote:

> So this intent is requesting to run the first OT M108-M110?

Correct.

> Any deprecation period you have in mind?

Good point. We should start by printing a warning message when these fields are accessed for a few milestones. M105--M107 would be good. Do I need to resend this as an intent to deprecate first?

LGTM to deprecate as well. From my perspective, you could start deprecating earlier than 105, assuming we know the timelines we're aiming for.

 

To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+unsubscribe@chromium.org.

[Rouslan Solomakhin]

> Chrome is reaching out to the known partners that may be depending on these fields.

We have reached out to the known partners with dev-trial instructions and received back feedback that this change does not affect their API usage.

> Estimated milestones
> Origin trial: 108

> LGTM to run Origin Trial removal 108-110

M108 is upon us. We intend to start the origin trial shortly.

[Rouslan Solomakhin]

Hello,

FYI, we are renaming the flag and reversing its meaning to make the Origin Trial framework work.

• Dev Trial: chrome://flags/#identity-in-can-make-payment - enabled by default. Disabling this flag would remove the fields from the "canmakepayment" event.
• Origin Trial: chrome://flags/#clear-identity-in-can-make-payment - disabled by default. Enabling this flag will remove fields from the "canmakepayment" event.

This change is necessary because Origin Trials can only enable runtime flags, not disable them. So, a flag must be default-disabled to be togglable by an Origin Trial. More information is available in Proposal to Fix the CanMakePayment Identity OT. This has also been discussed on blink-reviews-bindings@.

If you are feature-detecting the presence of the fields in the event, the most reliable way is:

  if (event.topOrigin) {}

  if (event.paymentRequestOrigin) {}

  if (evt.methodData && evt.methodData.length > 0) {}

  if (evt.modifiers && evt.modifiers.length > 0) {}

Cheers,

Rouslan

[Stephen McGruer]

Hi folks,

TL;DR - we are requesting LGTM x3 to Remove this API in M111. Please let us know if we need to send a new Intent thread for that.

As we look at M111 coming up, we realized we made a communication error here which we would like to correct. The original post said:

> Estimated milestones
> Origin trial: 108
> Reverse origin trial: 111
> Removal: 114

This was a misunderstanding over what Removal meant. We thought "Reverse origin trial" implied that the feature would be disabled by default in M111, with a reverse-OT to re-enable it if needed, and then Removal was when the feature was completely off with no way to re-enable. However based on Yoav's comments above, we think API Owners may have thought that we were not intending to disable this feature until M114.

So we are explicitly seeking approval to Remove this API in M111, alongside starting a reverse Origin Trial to guard against developers being caught by surprise. To the best of our knowledge this reverse Origin Trial will probably be unnecessary, as all known payment partners using PaymentHandler do not utilize these fields, however we are including it as a safe-guard.

No developer signed up to the current Origin Trial, unfortunately (possibly because there is no impact), so we have no data from that.

Please let us know if we should send a separate Intent to Remove thread instead, happy to do so.

Thanks,
Stephen

[Chris Harrelson]

Reusing this thread is fine, but please update the chromestatus entry to indicate the "shipping" stage.

To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.

To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAMMzaWFz1UFWxgOs%2BECSdF2Bt8JpsBkGtv2wMnq2pemGMmD8Fw%40mail.gmail.com.

--

You received this message because you are subscribed to the Google Groups "blink-dev" group.

To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/f36b8343-bf42-4e69-99de-e2530de63182n%40chromium.org.

[Stephen Mcgruer]

> please update the chromestatus entry to indicate the "shipping" stage.

Done, thanks. This also made us realize we hadn't actually published the spec change (!); that is now up for review and we are working on associated WPT test changes.

[Rouslan Solomakhin]

Hi,

Just to make sure, do we have the approval to ship the removal in M111 (together with an origin trial to un-remove for 3 milestones)?

Happy Holidays!

Cheers,

Rouslan

To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+unsubscribe@chromium.org.

To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAMMzaWFz1UFWxgOs%2BECSdF2Bt8JpsBkGtv2wMnq2pemGMmD8Fw%40mail.gmail.com.

--
You received this message because you are subscribed to the Google Groups "blink-dev" group.

To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+unsubscribe@chromium.org.

[Rick Byers]

Shoot, sorry - I think a downside of re-using an existing thread is that it doesn't show up in our approval tooling as an item needing action from API owners.

Thanks for landing the spec change. Are WPT changes now done too?

LGTM1 to remove, but you need two more. It looks like Chris and Yoav are now on vacation, but I'll try pinging a couple others.

Rick

To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.

To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAMMzaWFz1UFWxgOs%2BECSdF2Bt8JpsBkGtv2wMnq2pemGMmD8Fw%40mail.gmail.com.

--
You received this message because you are subscribed to the Google Groups "blink-dev" group.

To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.

To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/f36b8343-bf42-4e69-99de-e2530de63182n%40chromium.org.

--

You received this message because you are subscribed to the Google Groups "blink-dev" group.

To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/fa8d14cf-e4cc-460f-8fff-2cdd78233d79n%40chromium.org.

[Philip Jägenstedt]

LGTM2 assuming tests matching the spec land and pass.

To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAFUtAY_f%3DTndWrL0uTH8fCD9HxeXRU%2Bkt%2B0B5_t4ibhs_YGuRQ%40mail.gmail.com.

[Mike Taylor]

LGTM3 (with same conditions as Philip)

To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAARdPYdFeCgcswdSAvg%2BRJ1dBkUMuu4v63-Sw57F3rP8%3DoCVTA%40mail.gmail.com.

[Rouslan Solomakhin]

The spec changes have landed with the WPTs update coming next. For the WPTs to pass, our code needs to change. I will make both code and WPT changes in the same patch.

[Rick Byers]

SGTM, thanks Rouslan! And sorry again for this thread dropping off API owner radar.

[Rouslan Solomakhin]

Hey... no worries! The lesson here is to use a new thread next time :-D

Happy Holidays! 🎄 ☃️