Integration of Secure Payment Confirmation #30439

ianbjacobs · 2023-11-21T22:00:37Z

Description

This pull request supersedes pull request 28705 based on discussion for how best to structure the integration of Secure Payment Confirmation (SPC).

Motivation

SPC is already shipping in several browsers and should be documented on MDN.

Additional details

Related issues and pull requests

Relates to #421.

cc @wbamberg, @stephenmcgruer, @mountainhippo

ianbjacobs · 2023-11-21T22:01:36Z

Hi @wbamberg! Here's my first pass at integrating as we discussed on #28705; I am sure edits will be needed and look forward to your review.

github-actions

Remaining comments which cannot be posted as a review comment to avoid GitHub Rate Limit

mdn-linter

files/en-us/web/api/securepaymentconfirmationrequest/index.md|37|
files/en-us/web/api/securepaymentconfirmationrequest/index.md|42|
files/en-us/web/api/securepaymentconfirmationrequest/index.md|45|
files/en-us/web/api/securepaymentconfirmationrequest/index.md|50|
files/en-us/web/api/securepaymentconfirmationrequest/index.md|56|
files/en-us/web/api/securepaymentconfirmationrequest/index.md|60 col 1|

github-actions · 2023-11-21T22:01:34Z

files/en-us/web/api/payment_request_api/concepts/index.md

@@ -34,11 +34,14 @@ Payment handlers are identified by **payment method identifiers**, which are str

 ### Standardized payment method identifiers

-There is currently only one registered [standardized payment method identifier](https://www.w3.org/TR/payment-method-id/#registry) (more may be added in the future):
+- `secure-payment-confirmation`
+  - : The [standardized payment method dentifier](https://www.w3.org/TR/payment-method-id/#registry)


[mdn-linter] _{reported by reviewdog 🐶}

Suggested change

- : The [standardized payment method dentifier](https://www.w3.org/TR/payment-method-id/#registry)

- : The [standardized payment method dentifier](https://www.w3.org/TR/payment-method-id/#registry)

github-actions · 2023-11-21T22:01:34Z

files/en-us/web/api/payment_request_api/concepts/index.md

-There is currently only one registered [standardized payment method identifier](https://www.w3.org/TR/payment-method-id/#registry) (more may be added in the future):
+- `secure-payment-confirmation`
+  - : The [standardized payment method dentifier](https://www.w3.org/TR/payment-method-id/#registry)
+for [Secure Payment Confirmation](https://w3c.github.io/secure-payment-confirmation) is "secure-payment-confirmation". The Payment Request data for this payment is defined by the [SecurePaymentConfirmationRequest dictionary](/en-US/docs/Web/API/SecurePaymentConfirmationRequest). For more information see [Using Payment Request API for Secure Payment Confirmation](/en-US/docs/Web/API/Payment_Request_API/Using_with_Secure_Payment_Confirmation).


[mdn-linter] _{reported by reviewdog 🐶}

Suggested change

for [Secure Payment Confirmation](https://w3c.github.io/secure-payment-confirmation) is "secure-payment-confirmation". The Payment Request data for this payment is defined by the [SecurePaymentConfirmationRequest dictionary](/en-US/docs/Web/API/SecurePaymentConfirmationRequest). For more information see [Using Payment Request API for Secure Payment Confirmation](/en-US/docs/Web/API/Payment_Request_API/Using_with_Secure_Payment_Confirmation).

for [Secure Payment Confirmation](https://w3c.github.io/secure-payment-confirmation) is "secure-payment-confirmation". The Payment Request data for this payment is defined by the [SecurePaymentConfirmationRequest dictionary](/en-US/docs/Web/API/SecurePaymentConfirmationRequest). For more information see [Using Payment Request API for Secure Payment Confirmation](/en-US/docs/Web/API/Payment_Request_API/Using_with_Secure_Payment_Confirmation).

files/en-us/web/api/payment_request_api/concepts/index.md

files/en-us/web/api/payment_request_api/usingwithsecurepaymentconfirmation/index.md

github-actions · 2023-11-21T22:01:38Z

files/en-us/web/api/securepaymentconfirmationrequest/index.md

+-  `challenge`
+  - : A random [challenge](/en-US/docs/Web/API/CredentialsContainer/create#challenge) that the relying party generates on the server side
+	to prevent replay attacks.
+
+-  `rpId`
+  - : The [Relying Party Identifier](/en-US/docs/Web/API/CredentialsContainer/get#rpid) of the credentials.


[mdn-linter] _{reported by reviewdog 🐶}

Suggested change

- `challenge`

- : A random [challenge](/en-US/docs/Web/API/CredentialsContainer/create#challenge) that the relying party generates on the server side

to prevent replay attacks.

- `rpId`

- : The [Relying Party Identifier](/en-US/docs/Web/API/CredentialsContainer/get#rpid) of the credentials.

- `challenge`

- : A random [challenge](/en-US/docs/Web/API/CredentialsContainer/create#challenge) that the relying party generates on the server side

to prevent replay attacks.

github-actions · 2023-11-21T22:01:38Z

files/en-us/web/api/securepaymentconfirmationrequest/index.md

+-  `credentialIds`
+  - : The list of credential identifiers for the given instrument.


[mdn-linter] _{reported by reviewdog 🐶}

Suggested change

- `credentialIds`

- : The list of credential identifiers for the given instrument.

- `rpId`

- : The [Relying Party Identifier](/en-US/docs/Web/API/CredentialsContainer/get#rpid) of the credentials.

github-actions · 2023-11-21T22:01:38Z

files/en-us/web/api/securepaymentconfirmationrequest/index.md

+-  `instrument`
+  - : The description of the instrument name and icon to display during
+	registration and to be signed along with the transaction details.


[mdn-linter] _{reported by reviewdog 🐶}

Suggested change

- `instrument`

- : The description of the instrument name and icon to display during

registration and to be signed along with the transaction details.

- `credentialIds`

- : The list of credential identifiers for the given instrument.

github-actions · 2023-11-21T22:01:38Z

files/en-us/web/api/securepaymentconfirmationrequest/index.md

+-  `timeout`
+  - : The number of milliseconds before the request to sign the transaction
+	details times out. At most 1 hour.


[mdn-linter] _{reported by reviewdog 🐶}

Suggested change

- `timeout`

- : The number of milliseconds before the request to sign the transaction

details times out. At most 1 hour.

- `instrument`

- : The description of the instrument name and icon to display during

registration and to be signed along with the transaction details.

github-actions · 2023-11-21T22:01:38Z

files/en-us/web/api/securepaymentconfirmationrequest/index.md

+-  `payeeName`
+  - : The display name of the payee that this SPC call is for (e.g., the
+	merchant). Optional, may be provided alongside or instead of
+	payeeOrigin.


[mdn-linter] _{reported by reviewdog 🐶}

Suggested change

- `payeeName`

- : The display name of the payee that this SPC call is for (e.g., the

merchant). Optional, may be provided alongside or instead of

payeeOrigin.

- `timeout`

- : The number of milliseconds before the request to sign the transaction

details times out. At most 1 hour.

github-actions · 2023-11-21T22:01:42Z

files/en-us/web/api/securepaymentconfirmationrequest/index.md

@@ -0,0 +1,63 @@
+---


[markdownlint] _{reported by reviewdog 🐶}
MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: ---]

files/en-us/web/api/payment_request_api/concepts/index.md

github-actions · 2023-11-22T00:01:01Z

files/en-us/web/api/securepaymentconfirmationrequest/index.md

+-  `payeeOrigin`
+  - : The [=/origin=] of the payee that this SPC call is for (e.g., the
+	merchant). Optional, may be provided alongside or instead of
+	payeeName.


[mdn-linter] _{reported by reviewdog 🐶}

Suggested change

- `payeeOrigin`

- : The [=/origin=] of the payee that this SPC call is for (e.g., the

merchant). Optional, may be provided alongside or instead of

payeeName.

- `payeeName`

- : The display name of the payee that this SPC call is for (e.g., the

merchant). Optional, may be provided alongside or instead of

payeeOrigin.

github-actions · 2023-11-22T00:01:02Z

files/en-us/web/api/securepaymentconfirmationrequest/index.md

+-  `extensions`
+  - : Any [WebAuthn extensions](/en-US/docs/Web/API/Web_Authentication_API/WebAuthn_extensions) that should be used for the passed credential(s). The caller does not need to specify the [payment extension](/en-US/docs/Web/API/Web_Authentication_API/WebAuthn_extensions#payment); it is added automatically.


[mdn-linter] _{reported by reviewdog 🐶}

Suggested change

- `extensions`

- : Any [WebAuthn extensions](/en-US/docs/Web/API/Web_Authentication_API/WebAuthn_extensions) that should be used for the passed credential(s). The caller does not need to specify the [payment extension](/en-US/docs/Web/API/Web_Authentication_API/WebAuthn_extensions#payment); it is added automatically.

- `payeeOrigin`

- : The [=/origin=] of the payee that this SPC call is for (e.g., the

merchant). Optional, may be provided alongside or instead of

payeeName.

github-actions · 2023-11-22T00:01:02Z

files/en-us/web/api/securepaymentconfirmationrequest/index.md

+-  `locale`
+  - : An optional list of well-formed {{RFC(5646, "Tags for Identifying Languages (also known as BCP 47)")}} language tags, in descending
+	order of priority, that identify the local preferences of the
+	website, i.e. a language priority list {{RFC(4647, "Matching of Language Tags")}}, which the user agent can use to perform [language negotiation](/en-US/docs/Web/HTTP/Content_negotiation) and locale-affected formatting with the caller.


[mdn-linter] _{reported by reviewdog 🐶}

Suggested change

- `locale`

- : An optional list of well-formed {{RFC(5646, "Tags for Identifying Languages (also known as BCP 47)")}} language tags, in descending

order of priority, that identify the local preferences of the

website, i.e. a language priority list {{RFC(4647, "Matching of Language Tags")}}, which the user agent can use to perform [language negotiation](/en-US/docs/Web/HTTP/Content_negotiation) and locale-affected formatting with the caller.

- `extensions`

- : Any [WebAuthn extensions](/en-US/docs/Web/API/Web_Authentication_API/WebAuthn_extensions) that should be used for the passed credential(s). The caller does not need to specify the [payment extension](/en-US/docs/Web/API/Web_Authentication_API/WebAuthn_extensions#payment); it is added automatically.

github-actions · 2023-11-22T00:01:02Z

files/en-us/web/api/securepaymentconfirmationrequest/index.md

+	NOTE: The locale is distinct from
+      	language or direction metadata associated with specific input
+      	members, in that it represents the caller's requested localized
+      	experience rather than assertion about a specific string value.
+      	See [SPC internationalization Considerations](https://w3c.github.io/secure-payment-confirmation/#sctn-i18n-considerations) for more discussion.


[mdn-linter] _{reported by reviewdog 🐶}

Suggested change

NOTE: The locale is distinct from

language or direction metadata associated with specific input

members, in that it represents the caller's requested localized

experience rather than assertion about a specific string value.

See [SPC internationalization Considerations](https://w3c.github.io/secure-payment-confirmation/#sctn-i18n-considerations) for more discussion.

- `locale`

- : An optional list of well-formed {{RFC(5646, "Tags for Identifying Languages (also known as BCP 47)")}} language tags, in descending

order of priority, that identify the local preferences of the

website, i.e. a language priority list {{RFC(4647, "Matching of Language Tags")}}, which the user agent can use to perform [language negotiation](/en-US/docs/Web/HTTP/Content_negotiation) and locale-affected formatting with the caller.

github-actions · 2023-11-22T00:01:02Z

files/en-us/web/api/securepaymentconfirmationrequest/index.md

+-  `showOptOut`
+  - : Whether the user should be given a chance to opt-out during the
+	[transaction confirmation UX](https://w3c.github.io/secure-payment-confirmation/#sctn-transaction-confirmation-ux). Optional, default false.


[mdn-linter] _{reported by reviewdog 🐶}

Suggested change

- `showOptOut`

- : Whether the user should be given a chance to opt-out during the

[transaction confirmation UX](https://w3c.github.io/secure-payment-confirmation/#sctn-transaction-confirmation-ux). Optional, default false.

NOTE: The locale is distinct from

language or direction metadata associated with specific input

members, in that it represents the caller's requested localized

experience rather than assertion about a specific string value.

See [SPC internationalization Considerations](https://w3c.github.io/secure-payment-confirmation/#sctn-i18n-considerations) for more discussion.

files/en-us/web/api/securepaymentconfirmationrequest/index.md

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

…confirmation/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

github-actions · 2023-11-22T00:12:10Z

files/en-us/web/api/payment_request_api/usingwithsecurepaymentconfirmation/index.md

+
+Secure Payment Confirmation (SPC), available through the Payment Request API, provides a mechanism for strong customer authentication during checkout, thereby protecting against online payment fraud.
+
+To protect against online payment fraud, it is common to authenticate the account holder. Strong authentication lowers the risk of fraud, but increases the likelihood that friction during checkout will lead to shopping cart abandonment. Banks, merchants, payment services providers, and other entities in a payments ecosystem therefore consider a number of factors when deciding what type and strength of authentication to use for each transaction, including the amount, the items being purchased, the user's payment history, which party bears liability in the case of fraud, and regulatory requirements (such as [European Payment Services Directive 2](https://en.wikipedia.org/wiki/Payment_Services_Directive#Revised_Directive_on_Payment_Services_(PSD2)) requirements for strong customer authentication and evidence of user consent).


[mdn-linter] _{reported by reviewdog 🐶}

Suggested change

To protect against online payment fraud, it is common to authenticate the account holder. Strong authentication lowers the risk of fraud, but increases the likelihood that friction during checkout will lead to shopping cart abandonment. Banks, merchants, payment services providers, and other entities in a payments ecosystem therefore consider a number of factors when deciding what type and strength of authentication to use for each transaction, including the amount, the items being purchased, the user's payment history, which party bears liability in the case of fraud, and regulatory requirements (such as [European Payment Services Directive 2](https://en.wikipedia.org/wiki/Payment_Services_Directive#Revised_Directive_on_Payment_Services_(PSD2)) requirements for strong customer authentication and evidence of user consent).

To protect against online payment fraud, it is common to authenticate the account holder. Strong authentication lowers the risk of fraud, but increases the likelihood that friction during checkout will lead to shopping cart abandonment. Banks, merchants, payment services providers, and other entities in a payments ecosystem therefore consider a number of factors when deciding what type and strength of authentication to use for each transaction, including the amount, the items being purchased, the user's payment history, which party bears liability in the case of fraud, and regulatory requirements (such as [European Payment Services Directive 2](<https://en.wikipedia.org/wiki/Payment_Services_Directive#Revised_Directive_on_Payment_Services_(PSD2)>) requirements for strong customer authentication and evidence of user consent).

…confirmation/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

files/en-us/web/api/paymentrequest/paymentrequest/index.md

Co-authored-by: wbamberg <[email protected]>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* Alphabetical order * Data types provided * {{optional_inline}} added

files/en-us/web/api/securepaymentconfirmationrequest/index.md

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

ianbjacobs · 2023-11-30T22:54:38Z

@wbamberg, thanks for all the great suggestions. I think I have integrated them (including a directory name change).

@stephenmcgruer, there was a question about whether there is a default value for "timeout." I looked at the WebAuthn spec [1] which does not specify a default. Should we say nothing? Should we say the timeout is implementation dependent? Something else? Thanks!

[1] https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialcreationoptions-timeout

files/en-us/web/api/securepaymentconfirmationrequest/index.md

wbamberg

Thank you for the updates, @ianbjacobs , I reckon this is great. I'll merge this now and if we get an answer about the timeout default value, we can file a follow-up.

ianbjacobs · 2023-12-01T01:32:18Z

WHOHOO! Thank you @wbamberg, it's been a pleasure. I really appreciate all the time you devoted to making this happen!

* Create securepaymentconfirmation * Added secure-payment-confirmation PMI; deprecated basic-card * Create Using PR API for SPC * Add spacing * Add files via upload * Add bits for SPC to supportedMethods and data * Fix indent * Add payment extension * Editorial / typography fixes * Formatting fix * Update index.md * Update index.md * Update files/en-us/web/api/payment_request_api/concepts/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update files/en-us/web/api/payment_request_api/concepts/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update files/en-us/web/api/payment_request_api/usingwithsecurepaymentconfirmation/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update files/en-us/web/api/payment_request_api/usingwithsecurepaymentconfirmation/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update files/en-us/web/api/payment_request_api/usingwithsecurepaymentconfirmation/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update files/en-us/web/api/payment_request_api/usingwithsecurepaymentconfirmation/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update files/en-us/web/api/payment_request_api/usingwithsecurepaymentconfirmation/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update files/en-us/web/api/payment_request_api/usingwithsecurepaymentconfirmation/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update files/en-us/web/api/payment_request_api/usingwithsecurepaymentconfirmation/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update files/en-us/web/api/payment_request_api/usingwithsecurepaymentconfirmation/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update files/en-us/web/api/payment_request_api/usingwithsecurepaymentconfirmation/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update files/en-us/web/api/payment_request_api/usingwithsecurepaymentconfirmation/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update files/en-us/web/api/payment_request_api/usingwithsecurepaymentconfirmation/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update index.md * Update index.md * Update index.md * Apply suggestions from code review Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update index.md * Update index.md * Apply suggestions from code review Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update index.md * Update files/en-us/web/api/securepaymentconfirmationrequest/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update index.md * Update index.md * Update index.md * Update index.md * Update files/en-us/web/api/securepaymentconfirmationrequest/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Add H1 * Removed h1 * Update files/en-us/web/api/payment_request_api/usingwithsecurepaymentconfirmation/index.md * Update files/en-us/web/api/securepaymentconfirmationrequest/index.md * Update files/en-us/web/api/payment_request_api/usingwithsecurepaymentconfirmation/index.md * Rename dialog file * Fix lint errors * Delete files/en-us/web/api/payment_request_api/usingwithsecurepaymentconfirmation/chrome-tx-dialog.json * Add tx dialog image * Update files/en-us/web/api/payment_request_api/usingwithsecurepaymentconfirmation/index.md Co-authored-by: wbamberg <[email protected]> * Update files/en-us/web/api/securepaymentconfirmationrequest/index.md Co-authored-by: wbamberg <[email protected]> * Update files/en-us/web/api/securepaymentconfirmationrequest/index.md Co-authored-by: wbamberg <[email protected]> * Update files/en-us/web/api/web_authentication_api/webauthn_extensions/index.md Co-authored-by: wbamberg <[email protected]> * Update files/en-us/web/api/payment_request_api/usingwithsecurepaymentconfirmation/index.md Co-authored-by: wbamberg <[email protected]> * Update files/en-us/web/api/payment_request_api/usingwithsecurepaymentconfirmation/index.md Co-authored-by: wbamberg <[email protected]> * Update files/en-us/web/api/securepaymentconfirmationrequest/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update files/en-us/web/api/payment_request_api/usingwithsecurepaymentconfirmation/index.md Co-authored-by: wbamberg <[email protected]> * Update files/en-us/web/api/payment_request_api/usingwithsecurepaymentconfirmation/index.md Co-authored-by: wbamberg <[email protected]> * Update files/en-us/web/api/payment_request_api/usingwithsecurepaymentconfirmation/index.md Co-authored-by: wbamberg <[email protected]> * Update files/en-us/web/api/payment_request_api/usingwithsecurepaymentconfirmation/index.md Co-authored-by: wbamberg <[email protected]> * Update files/en-us/web/api/payment_request_api/usingwithsecurepaymentconfirmation/index.md Co-authored-by: wbamberg <[email protected]> * Update files/en-us/web/api/payment_request_api/concepts/index.md Co-authored-by: wbamberg <[email protected]> * Update files/en-us/web/api/securepaymentconfirmationrequest/index.md Co-authored-by: wbamberg <[email protected]> * Update files/en-us/web/api/securepaymentconfirmationrequest/index.md Co-authored-by: wbamberg <[email protected]> * Update files/en-us/web/api/securepaymentconfirmationrequest/index.md Co-authored-by: wbamberg <[email protected]> * Update files/en-us/web/api/securepaymentconfirmationrequest/index.md Co-authored-by: wbamberg <[email protected]> * Update files/en-us/web/api/securepaymentconfirmationrequest/index.md Co-authored-by: wbamberg <[email protected]> * Pull link to PMI registry out of SPC definition. * Adopted proposal including link update * Update files/en-us/web/api/payment_request_api/usingwithsecurepaymentconfirmation/index.md Co-authored-by: wbamberg <[email protected]> * Update files/en-us/web/api/payment_request_api/usingwithsecurepaymentconfirmation/index.md Co-authored-by: wbamberg <[email protected]> * Rename dir * Update files/en-us/web/api/securepaymentconfirmationrequest/index.md Co-authored-by: wbamberg <[email protected]> * Update files/en-us/web/api/web_authentication_api/webauthn_extensions/index.md Co-authored-by: wbamberg <[email protected]> * updated supportedMethods * Update files/en-us/web/api/paymentrequest/paymentrequest/index.md Co-authored-by: wbamberg <[email protected]> * Update files/en-us/web/api/paymentrequest/paymentrequest/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update files/en-us/web/api/securepaymentconfirmationrequest/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update instance properties * Alphabetical order * Data types provided * {{optional_inline}} added * Editorial. * Update files/en-us/web/api/securepaymentconfirmationrequest/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Use lc in directory name * Update files/en-us/web/api/securepaymentconfirmationrequest/index.md * Update Payment Request API sidebar --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: wbamberg <[email protected]>

stephenmcgruer · 2023-12-05T21:12:43Z

@stephenmcgruer, there was a question about whether there is a default value for "timeout." I looked at the WebAuthn spec [1] which does not specify a default. Should we say nothing? Should we say the timeout is implementation dependent? Something else? Thanks!

There is a suggested default in the WebAuthn spec - https://www.w3.org/TR/webauthn-2/#ref-for-dom-publickeycredentialcreationoptions-timeout . So could reference that, or could say its implementation dependent (which it is).

ianbjacobs · 2023-12-07T18:20:30Z

I now see that the Web Authentication documentation on MDN about timeout is here:
https://developer.mozilla.org/en-US/docs/Web/API/CredentialsContainer/create#timeout

So another option is to reference that definition. However, that definition does not indicate a default.

My preference at this point is to refer to the Web Authentication specification. Stephen, should we also refer to the Web Authentication specification from the SPC definition of timeout?

stephenmcgruer · 2023-12-07T18:52:25Z

Stephen, should we also refer to the Web Authentication specification from the SPC definition of timeout?

I would happily review a PR to do so. :)

ianbjacobs · 2023-12-08T03:00:08Z

So let it be written, so let it be done:
w3c/secure-payment-confirmation#265

ianbjacobs added 10 commits November 21, 2023 15:42

Create securepaymentconfirmation

0a98ba2

Added secure-payment-confirmation PMI; deprecated basic-card

2e05011

Create Using PR API for SPC

a7671ae

Add spacing

3acc967

Add files via upload

115f1f0

Add bits for SPC to supportedMethods and data

7aba4ea

Fix indent

24a5acd

Add payment extension

1322797

Editorial / typography fixes

d538353

Formatting fix

483d2e2

ianbjacobs requested a review from a team as a code owner November 21, 2023 22:00

ianbjacobs requested review from wbamberg and removed request for a team November 21, 2023 22:00

github-actions bot added the Content:WebAPI Web API docs label Nov 21, 2023

github-actions bot reviewed Nov 21, 2023

View reviewed changes

Update index.md

6f23171

github-actions bot reviewed Nov 22, 2023

View reviewed changes

ianbjacobs and others added 4 commits November 21, 2023 18:03

Update index.md

088f6c6

Update files/en-us/web/api/payment_request_api/concepts/index.md

4c403d9

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update files/en-us/web/api/payment_request_api/concepts/index.md

394a5cb

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update files/en-us/web/api/payment_request_api/usingwithsecurepayment…

129f338

…confirmation/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

github-actions bot reviewed Nov 22, 2023

View reviewed changes

ianbjacobs and others added 6 commits November 21, 2023 18:12

Update files/en-us/web/api/payment_request_api/usingwithsecurepayment…

be02eaa

…confirmation/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update files/en-us/web/api/payment_request_api/usingwithsecurepayment…

197b872

…confirmation/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update files/en-us/web/api/payment_request_api/usingwithsecurepayment…

ffbacda

…confirmation/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update files/en-us/web/api/payment_request_api/usingwithsecurepayment…

1bba266

…confirmation/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update files/en-us/web/api/payment_request_api/usingwithsecurepayment…

bcba29e

…confirmation/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update files/en-us/web/api/payment_request_api/usingwithsecurepayment…

70fabcd

…confirmation/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

updated supportedMethods

b3c43e1

github-actions bot reviewed Nov 30, 2023

View reviewed changes

files/en-us/web/api/paymentrequest/paymentrequest/index.md Outdated Show resolved Hide resolved

ianbjacobs and others added 4 commits November 30, 2023 16:19

Update files/en-us/web/api/paymentrequest/paymentrequest/index.md

525072c

Co-authored-by: wbamberg <[email protected]>

Update files/en-us/web/api/paymentrequest/paymentrequest/index.md

f58352a

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update files/en-us/web/api/securepaymentconfirmationrequest/index.md

e977c80

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Update instance properties

ecd21f6

* Alphabetical order * Data types provided * {{optional_inline}} added

github-actions bot reviewed Nov 30, 2023

View reviewed changes

files/en-us/web/api/securepaymentconfirmationrequest/index.md Outdated Show resolved Hide resolved

ianbjacobs and others added 2 commits November 30, 2023 16:50

Editorial.

1f6afe8

Update files/en-us/web/api/securepaymentconfirmationrequest/index.md

6cd61f6

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Use lc in directory name

d87b455

wbamberg reviewed Dec 1, 2023

View reviewed changes

files/en-us/web/api/securepaymentconfirmationrequest/index.md Outdated Show resolved Hide resolved

wbamberg added 2 commits November 30, 2023 16:39

Update files/en-us/web/api/securepaymentconfirmationrequest/index.md

9ef0483

Update Payment Request API sidebar

4c6a874

wbamberg requested a review from a team as a code owner December 1, 2023 00:47

wbamberg requested review from bsmth and removed request for a team December 1, 2023 00:47

wbamberg approved these changes Dec 1, 2023

View reviewed changes

wbamberg merged commit 4c5944b into mdn:main Dec 1, 2023
8 checks passed

This was referenced Dec 1, 2023

Tweaks to SPC documentation following extensive edits #30714

Merged

Add BCD data for Secure Payment Confirmation mdn/browser-compat-data#20583

Closed

ianbjacobs deleted the spc-202311 branch December 7, 2023 18:14

skyclouds2001 mentioned this pull request Dec 25, 2023

Consider remove SecurePaymentConfirmationRequest dictionary #31287

Closed

Rumyra mentioned this pull request Jan 24, 2024

Intent to document Secure Payment Confirmation (SPC) mdn/mdn#421

Closed

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Integration of Secure Payment Confirmation #30439

Integration of Secure Payment Confirmation #30439

ianbjacobs commented Nov 21, 2023

ianbjacobs commented Nov 21, 2023

github-actions bot left a comment

github-actions bot Nov 21, 2023

github-actions bot Nov 21, 2023

github-actions bot Nov 21, 2023

github-actions bot Nov 21, 2023

github-actions bot Nov 21, 2023

github-actions bot Nov 21, 2023

github-actions bot Nov 21, 2023

github-actions bot Nov 21, 2023

github-actions bot Nov 22, 2023

github-actions bot Nov 22, 2023

github-actions bot Nov 22, 2023

github-actions bot Nov 22, 2023

github-actions bot Nov 22, 2023

github-actions bot Nov 22, 2023

ianbjacobs commented Nov 30, 2023

wbamberg left a comment

ianbjacobs commented Dec 1, 2023

stephenmcgruer commented Dec 5, 2023

ianbjacobs commented Dec 7, 2023

stephenmcgruer commented Dec 7, 2023

ianbjacobs commented Dec 8, 2023

	- : The [standardized payment method dentifier](https://www.w3.org/TR/payment-method-id/#registry)

	- : The [standardized payment method dentifier](https://www.w3.org/TR/payment-method-id/#registry)

		- `credentialIds`
		- : The list of credential identifiers for the given instrument.

		- `extensions`
		- : Any [WebAuthn extensions](/en-US/docs/Web/API/Web_Authentication_API/WebAuthn_extensions) that should be used for the passed credential(s). The caller does not need to specify the [payment extension](/en-US/docs/Web/API/Web_Authentication_API/WebAuthn_extensions#payment); it is added automatically.


		Secure Payment Confirmation (SPC), available through the Payment Request API, provides a mechanism for strong customer authentication during checkout, thereby protecting against online payment fraud.

		To protect against online payment fraud, it is common to authenticate the account holder. Strong authentication lowers the risk of fraud, but increases the likelihood that friction during checkout will lead to shopping cart abandonment. Banks, merchants, payment services providers, and other entities in a payments ecosystem therefore consider a number of factors when deciding what type and strength of authentication to use for each transaction, including the amount, the items being purchased, the user's payment history, which party bears liability in the case of fraud, and regulatory requirements (such as [European Payment Services Directive 2](https://en.wikipedia.org/wiki/Payment_Services_Directive#Revised_Directive_on_Payment_Services_(PSD2)) requirements for strong customer authentication and evidence of user consent).

Integration of Secure Payment Confirmation #30439

Integration of Secure Payment Confirmation #30439

Conversation

ianbjacobs commented Nov 21, 2023

Description

Motivation

Additional details

Related issues and pull requests

ianbjacobs commented Nov 21, 2023

github-actions bot left a comment

Choose a reason for hiding this comment

github-actions bot Nov 21, 2023

Choose a reason for hiding this comment

github-actions bot Nov 21, 2023

Choose a reason for hiding this comment

github-actions bot Nov 21, 2023

Choose a reason for hiding this comment

github-actions bot Nov 21, 2023

Choose a reason for hiding this comment

github-actions bot Nov 21, 2023

Choose a reason for hiding this comment

github-actions bot Nov 21, 2023

Choose a reason for hiding this comment

github-actions bot Nov 21, 2023

Choose a reason for hiding this comment

github-actions bot Nov 21, 2023

Choose a reason for hiding this comment

github-actions bot Nov 22, 2023

Choose a reason for hiding this comment

github-actions bot Nov 22, 2023

Choose a reason for hiding this comment

github-actions bot Nov 22, 2023

Choose a reason for hiding this comment

github-actions bot Nov 22, 2023

Choose a reason for hiding this comment

github-actions bot Nov 22, 2023

Choose a reason for hiding this comment

github-actions bot Nov 22, 2023

Choose a reason for hiding this comment

ianbjacobs commented Nov 30, 2023

wbamberg left a comment

Choose a reason for hiding this comment

ianbjacobs commented Dec 1, 2023

stephenmcgruer commented Dec 5, 2023

ianbjacobs commented Dec 7, 2023

stephenmcgruer commented Dec 7, 2023

ianbjacobs commented Dec 8, 2023