WebUSB, WebHID, and Web Serial need an origin-level device policy
WebUSB, WebHID, and Web Serial need an origin-level device policy Browsers can now expose USB, human interface, and serial devices to web applications. These APIs make hardware workflows possible without a native installer. They also move a device permission decision into the web origin, where a compromised script, a third-party iframe, or an overly broad feature policy can change who gets…
The article discusses the need for an origin-level device policy for WebUSB, WebHID, and Web Serial APIs. These APIs allow web applications to access USB, human interface, and serial devices without a native installer, enabling hardware workflows. However, the device permission decision is moved into the web origin, which can be vulnerable to compromised scripts, third-party iframes, or overly broad feature policies.
The browser mediates access through a user-mediation point, but it does not guarantee the trustworthiness of every script on the origin. The article suggests implementing permissions policies, such as "usb", "hid", and "serial", to control access to specific APIs. It also recommends using a deny-by-default header for pages that do not require device access and filtering the chooser where the browser supports filters.
Additionally, the article advises testing iframe behavior from the same parent that runs in production and designing the device workflow as a capability, identifying the exact device class and operation.
Brief written by urgent.news from Dev.to's own syndicated text. Machine-written — may contain errors; check the original before relying on it.
