Is "monetization" always the correct fetch destination?

[lukewarlow]

Currently we have "monetization" setup as the destionation for wallet connection flows. This makes sense for the actual session flow as it's what the CSP monetization-src directive connects into (per WICG/webmonetization#549) but for wallet connection its actually a different wallet address that's being connected to it's the users wallet address.

It's not definitely wrong but worth considering this, and seeing what the destionation impacts other than CSP. For chrome web-ui CSP shouldn't be an issue because we just won't have monetization-src setup.

[lukewarlow]

cc @asurkov and @sidvishnoi

[lukewarlow]

One other thing to think about is the fact that when doing a session flow we want CSP monetization-src to control which website wallet addresses can be connected to. But we obviously need to allow all user wallet addresses to be connected to. So we need monetization-src to only apply to one side of the session flow. This probably means we need a different fetch destination for the user monetization side (both wallet connection and during session flow).

[sidvishnoi]

This probably means we need a different fetch destination for the user monetization side (both wallet connection and during session flow).

Maybe. Can we not have an allow-all wallet CSP in the wallet connection UI so it can still use the same fetch destination? Also, do we really need a fetch destination for the connect process - can it be skipped?

[lukewarlow]

For wallet connection if we just specify the destionation as the empty string (or just don't specify it at all thats the default) it'll by default be covered by "connect-src". Which is maybe fine, but chromium does have CSP for their internal UI pages and given the dynamic nature of user wallet addresses I think we'll need to do something special here to mark them as exempt from CSP entirely. Some example initiator destination combinations already have this exemption based on https://fetch.spec.whatwg.org/#destination-table so it should be doable.

Likewise we'd want the same exemption for user wallet addresses during the main session flow. Only the website wallet should be validated by monetization-src.

[sidvishnoi]

Only the website wallet should be validated by monetization-src.

Correct.

The user (connected) wallet won't need to be fetched again likely¹ - its info can be stored..

Footnotes

1. Unless it changes in some migration (server/domain switch), which will be BREAKING change from wallet - essentially connected wallet server went down. ↩