[=transient activation=], the user agent MAY:

<p class="note">

This allows the user agent to not require user activation, for

example to support redirect flows where a user activation may not

be present upon redirect. See

<a href="#user-activation-requirement"></a> for security

considerations.

</p>

<li data-tests="show-consume-activation.https.html">Otherwise,

[=consume user activation=] of the [=relevant global object=].

<section>

<h2 id="user-activation-requirement">

User activation requirement

</h2>

<p>

If the user agent does not require user activation as part of the

{{PaymentRequest/show()}} method, some additional security mitigations

should be considered. Not requiring user activation increases the risk

of spam and click-jacking attacks, by allowing a Payment Request UI

to be initiated without the user interacting with the page immediately

beforehand.

</p>

<p>

In order to mitigate spam, the user agent may decide to enforce a user

activation requirement after some threshold, for example after the

user has already been shown a Payment Request UI without a user

activation on the current page. In order to mitigate click-jacking

attacks, the user agent may implement a time threshold in which clicks

are ignored immediately after a dialog is shown.

</p>

<p>

Another relevant mitigation exists in step 6 of

{{PaymentRequest/show()}}, where the document must be visible in order

to initiate the user interaction.

</p>

</section>