Calling PaymentRequest.show without user activation

Category: Miscellaneous
Type: Feature removal
Status: Removed (Chrome 102)
Intent stage: Removed

Breaking change: No
Enterprise impact: None
Spec maturity: Working draft
Web Platform Tests: Yes

WPT details: https://wpt.fyi/results/payment-request/show-consume-activation.https.html?label=experimental&label=master&aligned

Summary

Allowing PaymentRequest.show() to be triggered without a user activation could be abused by malicious websites. To protect users, the spec was changed to require user activation, and we are now following through in the Chrome implementation.

Standards & signals

Specification: https://www.w3.org/TR/payment-request/#show-method
Firefox: In development
Safari: Shipped/Shipping
Web developers: No signals
Tracking bug: https://crbug.com/825270

Ecosystem

Web Platform Tests: https://wpt.fyi/results/?q=payment-request%2Fshow-consume-activation
Chrome Platform Showcase: https://chrome-platform-showcase.paulkinlan-ea.deno.net/features
GenDN reference: https://gendn.paulkinlan-ea.deno.net/features
chrome.dev demos search: https://www.google.com/search?q=site%3Achrome.dev+Calling%20PaymentRequest.show%20without%20user%20activation
MDN Web Docs: https://developer.mozilla.org/en-US/search?q=Calling%20PaymentRequest.show%20without%20user%20activation
Baseline status: https://webstatus.dev/?q=Calling%20PaymentRequest.show%20without%20user%20activation

View on chromestatus.com