Add privacy protection to MerchantValidationEvent's validationURL#850
Add privacy protection to MerchantValidationEvent's validationURL#850marcoscaceres merged 6 commits intogh-pagesfrom
Conversation
rsolomakhin
left a comment
There was a problem hiding this comment.
Thank you for the clarification. I will be sure to include this in the PH spec when adding the merchant validation feature and will add you the the PR for review.
ianbjacobs
left a comment
There was a problem hiding this comment.
I agree with the sentiment, but two things make me uncomfortable:
- Imposing a normative requirement on payment handlers in this specification.
- It would probably be ok for the URL to include some information about a person for an authorized server; we don't want that information to be visible to unauthorized parties.
Proposed:
"It is important that the validationURL in a MerchantValidationEvent
does not expose personally identifying information to unauthorized parties."
I am avoiding creating a normative requirement, but do want to stress the importance.
|
@ianbjacobs, your suggestion sounds good. Could you please update this branch with your new text? |
|
Hi @marcoscaceres, I made the change and also did a tidy; I think some of the changes shown are due to tidy. Ian |
…into merchant_validation
Part of PING discussions.
The following tasks have been completed:
Modified Web platform tests.Optional, impact on Payment Handler spec?
If handlers will have a means of handling merchant validation, that spec should include a privacy note.
Preview | Diff