Merchant identity in "canmakepayment" event

Category: Miscellaneous
Type: Feature removal
Status: Removed (Chrome 111)
Intent stage: Prepare to ship

Breaking change: No
Enterprise impact: None
Chromium flag: chrome://flags/#clear-identity-in-can-make-payment
Spec maturity: Unknown status
Web Platform Tests: Yes

WPT details: https://wpt.fyi/results/payment-handler

Summary

The “canmakepayment” service worker event lets the merchant know whether the user has a card on file in an installed payment app. It used to silently pass the merchant's origin and arbitrary data to a service worker from payment app origin. This cross-origin communication happened on PaymentRequest construction in JavaScript, did not require a user gesture, and did not show any user interface. This silent data passage has been removed from the "canmakepayment" event (and the Android IS_READY_TO_PAY Intent).

Motivation

To improve user privacy, remove the merchant origin and arbitrary data from the "canmakepayment" service worker event: - topOrigin - paymentRequestOrigin - methodData - modifiers

Standards & signals

Specification: https://w3c.github.io/payment-handler
Firefox: N/A
Safari: N/A
Web developers: Positive
Tracking bug: https://crbug.com/1290492

Ecosystem

Web Platform Tests: https://wpt.fyi/results/?q=payment-handler
Chrome Platform Showcase: https://chrome-platform-showcase.paulkinlan-ea.deno.net/features
GenDN reference: https://gendn.paulkinlan-ea.deno.net/features
chrome.dev demos search: https://www.google.com/search?q=site%3Achrome.dev+Merchant%20identity%20in%20%22canmakepayment%22%20event
MDN Web Docs: https://developer.mozilla.org/en-US/search?q=Merchant%20identity%20in%20%22canmakepayment%22%20event
Baseline status: https://webstatus.dev/?q=Merchant%20identity%20in%20%22canmakepayment%22%20event

Samples: https://rsolomakhin.github.io/pr/apps/romantic-dirt-jaguar

View on chromestatus.com