If we are going to treat this like a deprecation instead (which is what a report only mode sounds to me?), then it makes more sense to me to skip an OT entirely. That is:
- M108 - begin deprecation period, developers get warnings - M111 (for example) - enable behavior, start reverse origin trial if necessary for anyone to opt out for a few milestones. Thoughts Yoav? On Wed, Sept 21, 2022, 9:06 a.m. Rouslan Solomakhin <rous...@chromium.org> wrote: > > So is the plan to get properties currently using PaymentHandler to > experiment with this and see if there's breakage? > > Yes, that's the plan. > > > Should we initially ship a "report only" mode that would help all > properties know that CSP errors may be happening soon? > > Yes, we certainly could do that, if that's your recommendation. > Assuming that does not require a Blink intent, we can start doing that in > M108. Should we run the opt-in OT for enforcing CSP in M 110--112 in that > case? > > On Wed, Sep 21, 2022 at 1:30 AM Yoav Weiss <yoavwe...@chromium.org> wrote: > >> So is the plan to get properties currently using PaymentHandler to >> experiment with this and see if there's breakage? Should we initially ship >> a "report only" mode that would help all properties know that CSP errors >> may be happening soon? >> >> On Tue, Sep 20, 2022 at 6:20 PM Rouslan Solomakhin <rous...@chromium.org> >> wrote: >> >>> Contact emailssmcgr...@chromium.org, rous...@chromium.org >>> >>> Specification >>> https://www.w3.org/TR/payment-method-manifest/#processing-model >>> >>> Summary >>> >>> Deprecate the ability for Web Payment API to bypass the connect-src CSP >>> policy when fetching the manifest. After this deprecation, a site's >>> connect-src CSP policy will need to allow for the payment method URL >>> specified in a PaymentRequest call, as well as any other URLs that the >>> method chains to fetch its manifest. >>> >>> Blink componentBlink>Payments >>> <https://bugs.chromium.org/p/chromium/issues/list?q=component:Blink%3EPayments> >>> >>> TAG review statusNot applicable >>> >>> Risks >>> Interoperability and Compatibility*Gecko*: N/A. Does not currently >>> implement or ship PaymentHandler. >>> *WebKit*: N/A. Does not currently implement or ship PaymentHandler. >>> *Web developers*: No signals >>> >>> WebView application risks >>> >>> None: PaymentHanlders are not supported in WebView. >>> >>> Debuggability >>> >>> CSP violations print console error messages. >>> >>> Will this feature be supported on all six Blink platforms (Windows, Mac, >>> Linux, Chrome OS, Android, and Android WebView)?No. PaymentHandlers are >>> not supported on WebView. >>> >>> Is this feature fully tested by web-platform-tests?No >>> >>> Flag name#web-payment-api-csp >>> >>> Requires code in //chrome?False >>> >>> Tracking bughttps://crbug.com/1349091 >>> >>> Launch bughttps://crbug.com/1349093 >>> >>> Estimated milestones >>> Origin Trial first: 108 >>> Origin Trial last: 110 >>> >>> Link to entry on the Chrome Platform Status >>> https://chromestatus.com/feature/6286595631087616 >>> >>> Links to previous Intent discussionsIntent to prototype >>> <https://groups.google.com/a/chromium.org/g/blink-dev/c/jklZJYcOVyg/m/Gfwa4QQBAwAJ> >>> . >>> >>> This intent message was generated by Chrome Platform Status >>> <https://chromestatus.com/>. >>> >>> -- >>> You received this message because you are subscribed to the Google >>> Groups "blink-dev" group. >>> To unsubscribe from this group and stop receiving emails from it, send >>> an email to blink-dev+unsubscr...@chromium.org. >>> To view this discussion on the web visit >>> https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAMMzaWFUbSFNuCbyefZKuSDmFtOd%3DD5xsOpVE0p6pwoxVPgRog%40mail.gmail.com >>> <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAMMzaWFUbSFNuCbyefZKuSDmFtOd%3DD5xsOpVE0p6pwoxVPgRog%40mail.gmail.com?utm_medium=email&utm_source=footer> >>> . >>> >> -- > You received this message because you are subscribed to the Google Groups > "blink-dev" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to blink-dev+unsubscr...@chromium.org. > To view this discussion on the web visit > https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAMMzaWFXYXBqDjBzC8RnjUmNXQ8apiBAHdAGMV16Pq0F%2BbV-Mg%40mail.gmail.com > <https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAMMzaWFXYXBqDjBzC8RnjUmNXQ8apiBAHdAGMV16Pq0F%2BbV-Mg%40mail.gmail.com?utm_medium=email&utm_source=footer> > . > -- You received this message because you are subscribed to the Google Groups "blink-dev" group. To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+unsubscr...@chromium.org. To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CADY3MacR62b90CCV2xBru_ZEP0P7Wjf4EqAdfcX_AZKXj%3D8UDg%40mail.gmail.com.
