search

w3c / payment-method-id

Payment Method Identifiers specification
https://w3c.github.io/payment-method-id/
Other
23 stars 20 forks source link

Support for PMI's with schemes other than https? #17

Closed adrianhopebailie closed 7 years ago

adrianhopebailie commented 7 years ago

From: https://github.com/w3c/webpayments-method-identifiers/pull/16#discussion_r88373861

There is a concern that having browsers all over the world fetching a manifest all the time will put significant strain on the hosts of the manifest.

There are protocols that are better at serving static content than HTTP such as IPFS. While they're not supported in most browsers yet, they may be soon.

So, should we be limiting the PMI URLs to https as the scheme or rather wording this as something that requires fetching the manifest through a SecureContext or similar?

rsolomakhin commented 7 years ago

+1 to rephrase "must start with https://" to say "must be hosted in a secure fashion." This opens the door to the future secure protocols.

marcoscaceres commented 7 years ago

I would get input from the WebSecWG before we change text here. In general, I agree with the intent - but if some weird "secure"(tm) protocol gets used by one UA, it risks screwing over all other UAs and remaining spec-conforming.

marcoscaceres commented 7 years ago

(fixed above)

ianbjacobs commented 7 years ago

Closed with adoption of PR 21 at 23 Feb Meeting http://www.w3.org/2017/02/23-wpwg-minutes.html