search

WICG / webusb

Connecting hardware to the web.
https://wicg.github.io/webusb/
Other
1.3k stars 126 forks source link

using host(port included) instead of the current origin to avoid possible security issue #215

Closed yorkie closed 2 years ago

yorkie commented 2 years ago

Background

I'm working on addressing an authentication issue about a WebADB library, which fails to authenticate when the website port has been changed, this is because the library uses localStorage to save the ADB cert and key to match with the device, however, the localStorage could not be shared between different ports(domains). In other words, this might be an inconsistent behavior between the localStorage and WebUSB.

Implementations

I have browsed some of the chromium source code, see the UsbChooserContext:: HasDevicePermission method, it uses the origin namely hostname, rather than the host(port not included).

Proposal

This spec doesn't specify how the UA should implement this part, if this proposal looks good to you guys, I can add some related.

reillyeon commented 2 years ago

An origin actually does consider both the host and port. See the definition from the HTML specification here: https://html.spec.whatwg.org/multipage/origin.html#concept-origin

Are you seeing different behavior in the Chromium implementation?

yorkie commented 2 years ago

Weird a bit, location.origin returns hostname:port, however when I changed the port, the chrome chooser tells that it's paired, I will have a look later.

reillyeon commented 2 years ago

I don't think the window.location.origin attribute is writable (or at least, the browser ignores writes to it) so changing the port there won't change the security principle of the page.

yorkie commented 2 years ago

@reillyeon I just use location.origin to verify if the origin contains the port part, and I won't change the port in that way, actually I did change the port by xxx start --port <port>.

reillyeon commented 2 years ago

I can't reproduce this behavior. The steps I tried:

  1. Launch a local web server on port 8000.
  2. Load http://localhost:8000.
  3. Call navigator.usb.requestDevice().
  4. Grant permission to a USB device.
  5. Switch the local web server to port 8080.
  6. Load http://localhost:8080.
  7. Call navigator.usb.requestDevice().
  8. Observe that the device is not marked as "Paired" and the device isn't listed in the set of site permissions when I click the lock icon. Checking chrome://settings/content/usbDevices also shows that http://localhost:8000 (with port) is listed as the site with permission to access the device.
yorkie commented 2 years ago

You are right, closing this issue :)