User Activation Requirement for SPC Credential Enrollment

Category: Miscellaneous
Type: No developer-visible change
Status: Enabled by default (Chrome 103)
Intent stage: Prepare to ship

Breaking change: No
Enterprise impact: None
Spec maturity: Working draft
Web Platform Tests: Yes

WPT details: Yes, coverage for the user activation requirement will be added to the existing test suite: https://wpt.fyi/results/secure-payment-confirmation?label=master&label=experimental&aligned

Summary

This intent is to add a user activation requirement for Secure Payment Confirmation (SPC) credential enrollment in a cross-origin iframe to help mitigate a privacy issue (see https://github.com/w3c/secure-payme for discussion of a potential identity tracking attack).

Standards & signals

Specification: https://w3c.github.io/secure-payment-confirmation
Firefox: No signal
Safari: No signal
Web developers: Positive — Support and involvement in API development from multiple web developers and payment industry partners. Both Stripe and AirBnB have publicly stated that they have either completed or are in the process of prototyping/experimenting with SPC
Tracking bug: https://crbug.com/1322603

Ecosystem

Web Platform Tests: https://wpt.fyi/results/?q=secure-payment-confirmation
Chrome Platform Showcase: https://chrome-platform-showcase.paulkinlan-ea.deno.net/features
GenDN reference: https://gendn.paulkinlan-ea.deno.net/features
chrome.dev demos search: https://www.google.com/search?q=site%3Achrome.dev+User%20Activation%20Requirement%20for%20SPC%20Credential%20Enrollment
MDN Web Docs: https://developer.mozilla.org/en-US/search?q=User%20Activation%20Requirement%20for%20SPC%20Credential%20Enrollment
Baseline status: https://webstatus.dev/?q=User%20Activation%20Requirement%20for%20SPC%20Credential%20Enrollment

Explainers: https://github.com/w3c/secure-payment-confirmation/blob/main/explainer.md

View on chromestatus.com