From a16d1c9f36e99fe63cdb928ac4ae57cbd83afd30 Mon Sep 17 00:00:00 2001 From: Vishal Katyal Date: Sun, 30 Aug 2026 20:54:09 -0400 Subject: [PATCH] docs(permalink): require explicit buyer action before cart merge Closes the CSRF-class gap identified in ucp#666: merging rendered permalink state into the existing cart of an authenticated buyer must now follow an explicit buyer action on that rendered state. Automatic merges on load, on redirect, or through a pre-filled submission do not satisfy this requirement. Rule proposed in the issue thread and tightened with westonale-facet on 2026-08-14. Fixes #666 --- docs/specification/permalink.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/docs/specification/permalink.md b/docs/specification/permalink.md index cce4b9976..8ce945899 100644 --- a/docs/specification/permalink.md +++ b/docs/specification/permalink.md @@ -455,6 +455,11 @@ A Business MAY also require additional steps — such as verification, eligibili or age gating, or authentication — before it constructs purchasable state, and routes the buyer accordingly. +A Business MUST require an explicit buyer action on rendered permalink state +before merging that state into an authenticated buyer's existing cart. An +automatic merge performed on page load, on redirect, or through a pre-filled +submission does not satisfy this requirement. + A Business SHOULD apply query parameters it understands. Applied parameters may affect server-side state or destination selection, and are not required to appear on the redirect URL. UCP field-path query parameters SHOULD be consumed