View Issue Details

IDProjectCategoryView StatusLast Update
0004950Talerwallet (WebExtension)public2020-07-16 21:01
ReporterFlorian Dold Assigned ToChristian Grothoff Resolution deadline
ImplementerReviewer 
Release signed byDeployed by 
VerifierCommunicator 
Data protection authority notification requiredNo  
CSIRT notification requiredNo  
Estimated effort (hours)Actual effort (hours)0 
Fast-trackNo
Work packagenone
PrioritynormalSeveritytextReproducibilityhave not tried
Status closedResolutionwon't fix 
Product Versiongit (master) 
Target Version0.7.1Fixed in Version0.7.1 
Summary0004950: spec and implement asynchronous payment api
DescriptionThere should be a payment API for JavaScript heavy applications, where the page can make a payment request and the user has to confirm inside the extension popup.

This has the benefit of being more resilient against click jacking.
TagsNo tags attached.

Required notifications

Address or linkRemarkAdded byNotifiedActions

Activities

Florian Dold

2018-03-07 20:39

manager   ~0012879

Since we can now query the status of a payment (instead of having cookies set on /pay), it is pretty easy to do payments from a Single Page App without destroying state by opening the payment_redirect_url in a new tab/window.

We still might re-add a JS-based API for synchronous payments in the future, since:
* it might provide nicer user experience than opening a tab/window by using browser-specific APIs (such as W3C payment handler/requests)
* the developer experience might be nicer

However in order to implement the latter part, the backend might have to expose APIs to the browser that right now only the frontend server has access to, such as querying the status of a payment (paid, not paid, refunded) based on an order id.

It is probably not desirable to expose such an API to the public by default. Maybe the frontend can proxy these requests to the backend, but then we need to make sure we still have a nice API where we don't need to pass a slew of URLs around.

Florian Dold

2020-07-16 17:58

manager   ~0016473

IMHO we don't need an async payment API even for 1.0. Probably not ever. This bug was opened before we had the nice, HTTP-based wallet triggering.

All potential use cases can be covered by just opening a new tab (or popup, window ...) that handles the payment.

The argument against having such an API is that it makes detached wallets (i.e. on your mobile phone) a second-class citizen. We didn't even have mobile wallets when we opened this bug.

As I don't even see us doing this post-1.0 (unless we get some really specific and reasonable use case), I would resolve this as "won't fix".

Christian Grothoff

2020-07-16 21:01

manager   ~0016483

Ok.

Issue History

Date ModifiedUsernameFieldChange
2017-03-10 23:15Florian DoldNew Issue
2017-03-14 11:03Christian GrothoffSeverityminor => feature
2017-03-14 11:04Christian GrothoffStatusnew => implementing
2017-03-14 11:04Christian GrothoffCategoryother => wallet (browser-based)
2017-03-14 11:04Christian GrothoffProduct Version => git (master)
2017-10-23 08:44Christian GrothoffAssigned To => Florian Dold
2017-10-23 08:44Christian GrothoffSeverityfeature => text
2017-10-23 08:44Christian GrothoffStatusimplementing => assigned
2017-10-23 08:44Christian GrothoffTarget Version => 0.7.1
2018-03-07 20:39Florian DoldNote Added: 0012879
2019-12-26 20:36Florian DoldCategorywallet (browser-based) => wallet (WebExtensions)
2020-07-16 17:58Florian DoldAssigned ToFlorian Dold => Christian Grothoff
2020-07-16 17:58Florian DoldStatusassigned => feedback
2020-07-16 17:58Florian DoldNote Added: 0016473
2020-07-16 21:01Christian GrothoffStatusfeedback => informing
2020-07-16 21:01Christian GrothoffResolutionopen => won't fix
2020-07-16 21:01Christian GrothoffFixed in Version => 0.7.1
2020-07-16 21:01Christian GrothoffNote Added: 0016483
2020-07-16 21:01Christian GrothoffStatusinforming => closed
2023-04-13 18:37Florian DoldCategorywallet (WebExtensions) => wallet (WebExtension)