demo · v141

Remote Desktop Relay

The canonical Web Smart Card scenario from the WICG explainer: a remote-desktop web app exposes the host's USB card reader to the remote machine as if it were directly attached. Login workflows that depend on PC/SC (US government Common Access Cards, healthcare smartcards, banking auth tokens) keep working over the remote session.

Heads up Web Smart Card ships ChromeOS-only initially, gated to Isolated Web Apps. chrome://flags/#enable-smart-card on ChromeOS to try. The probe below feature-detects.
checking support…

host (ChromeOS)

User's local machine. Smart card reader plugged in via USB. Web app runs in browser, uses navigator.smartCard.

→ relay →

remote VM

Remote Linux VM running a corporate app. Sees the smart card via standard PC/SC daemon — no changes to the corporate app.

no command run yet

the call

const sc = navigator.smartCard;            // SmartCardContext
const ctx = await sc.createContext();
const readers = await ctx.listReaders();
console.log("readers:", readers);

// Establish connection to a card in a specific reader
const conn = await ctx.connect(readers[0], "shared", { preferredProtocols: ["t1"] });
// APDU forwarding — the remote machine sends these through the relay
const apdu = new Uint8Array([0x00, 0xA4, 0x04, 0x00, 0x07, 0xA0, 0x00, 0x00, 0x03, 0x08, 0x00, 0x00]);
const resp = await conn.transmit(apdu);    // forward to card, return response

why this angle

The WICG README's first listed use case is remote-desktop relay: enterprises moving to web-based VDI clients (Chrome Remote Desktop, Citrix on ChromeOS, custom kiosk solutions) had a smart-card gap. Without the Web Smart Card API, the remote app couldn't see the host's card reader so PIV / CAC sign-on broke. With it, the host browser exposes PC/SC, the web app relays APDUs over the wire, and the remote machine treats the network-attached reader as local. This is a single-purpose API — narrow but irreplaceable for the enterprises that need it.

see also