Rayan Kanso

- This discussion is on the spec level so the implementation is irrelevant. - It's true that the cache API doesn't support requests with bodies, but I'm referring to the...

Is the question about the chromium implementation? If so it uses the regular CORS parser with extra restrictions, based on the spec changes [here](https://github.com/whatwg/fetch/pull/1312). My understanding from the reading of...

Considering the sensitive nature of this API in terms of privacy, I suggest taking it a step further and restricting it to top-level frames only. There's precedent for this in...

Thanks for sharing this Jeffrey, it was an interesting read. This API already applies the only relevant mitigation outlined in the paper (Selective Contact Permissions). When a website requests contact...

I like the idea of re-using autocomplete names, we might have to do something about icons though. @marcoscaceres, I'm assuming you mean returning a list of `FormData` (one per contact),...

> Perhaps. I wonder how clunky would it be to use a single FormData object, given that it supports multiple keys? I'd imagine the FormData would look something like this,...

> 2. the number of returned contacts is always keys' length/2 (with empties being the empty string) I don't think that's true, in the example I constructed `c1` has multiple...

Alright, so putting everything together, this is the new proposed structure: ```webidl interface ContactInfo { sequence name; sequence email; sequence tel; [default] object toJSON(); static FormData toFormData(sequence contacts); }; ```...

I like the motivation behind the Contact Discover API, but given that the hashing can be reversed, it would be no different than using the Contact Picker API directly.

@adityapunjani I agree it would be useful, but it is not critical for the feature to function, or critical for privacy/security reasons. The spec shouldn't enforce a `Select All` option,...