103-https-wallet-links.rst (3313B)
1 DD 103: HTTPS Links for Wallet Actions 2 ###################################### 3 4 :Design status: Draft 5 :Implementation status: Not started 6 :DD shepherd: Florian Dold 7 :Historical contributors: Florian Dold 8 :First published: 2026-09-07 9 :Last substantive change: 2026-09-07 10 11 Summary 12 ======= 13 14 This design document proposes using ``https://`` URLs as a fallback for ``taler://`` URIs. 15 16 Motivation 17 ========== 18 19 Some users of the Taler wallet have reported that applications they use 20 don't support ``taler://`` URIs nicely. Some applications don't render them correctly, 21 linking only the second part (after the ``taler://``) as a link, which then 22 usually leads them to an invalid page. 23 24 Requirements 25 ============ 26 27 * The solution should still allow alternative implementations of the wallet 28 not provided by the Taler project. 29 30 Proposed Solution 31 ================= 32 33 In addition to ``taler://`` URIs, wallets also register themselves as handlers 34 for ``https://wallet.taler.net/link/#``. The taler action is provided 35 after the ``#``. These ``https://`` URLs are directly 36 mapped to ``taler://`` URIs and interpreted by the wallet: 37 38 The following URLs 39 40 * ``https://wallet.taler.net/link#taler://${action}/${rest}`` 41 * ``https://wallet.taler.net/link#/${action}/${rest}`` 42 * ``https://wallet.taler.net/link#${action}/${rest}`` 43 44 are all mapped to ``taler://${action}/${rest}``. 45 46 47 Security Considerations 48 ======================= 49 50 * Since the payload of the encoded Taler action is in the fragment of the ``https://`` 51 URL, navigating to the URL does not send any data from the Taler action 52 to the server. 53 * If ``https:/wallet.taler.net/`` is compromised, an attacker 54 can intercept ``taler://`` URIs on a devices that does **not** 55 already have a wallet installed. 56 * Using ``https://wallet.taler.net/link#...`` links consistently on Websites would 57 allow the WebExtension wallet to run with considerably less broad 58 permissions. 59 60 Ecosystem Considerations 61 ======================== 62 63 * We can allow developers of alternative Taler wallets 64 to register themselves on Android / iOS. 65 * For F-Droid, packages are signed with the F-Droid key anyway, so allowing 66 this key to handle ``https://wallet.taler.net/link`` would allow alternative 67 Taler wallet implementations on F-Droid automatically. 68 69 Alternatives 70 ============ 71 72 * Push for widespread adoption of ``taler://`` URI support. 73 74 * That's what would happen in an ideal world, and we should still 75 push for it. 76 77 * Use the domain of exchanges to encode Taler actions, e.g. ``https://exchange.taler-ops.ch/#pay/...``. 78 79 * This requires trusting *more* servers 80 * It leads to an ``NxM`` issues where ``N`` wallets would 81 need to apply at ``M`` exchanges to be allowed to register 82 as a handler for their URL. 83 84 Discussion / Q&A 85 ================ 86 87 * Why use ``https://wallet.taler.net/link``? 88 89 * The link is easily recognizeable as a link for the Taler wallet. 90 91 * The words ``link``, ``wallet``, ``taler`` and ``net`` are relatively 92 well-known even in other languages. 93 94 * When no wallet is installed, this is exactly the location we want the user 95 to be navigated to, as it asks the user to install a wallet 96 97 * Since ``wallet.taler.net`` is owned by the Taler project and links to the 98 wallets, they can be considered part of the same trust domain.