v143 · capabilities (fugu)

Web Smart Card API

Enables smart card (PC/SC) applications to move to the Web platform. It gives them access to the PC/SC implementation (and card reader drivers) available in the host OS.

concepts

  1. Smart Card Connect

    Step-by-step PC/SC probe: establishContext → listReaders → connect → transmit your own APDU. Reports which gate (no API, no policy, no readers) blocks the flow.

  2. Remote desktop relay

    The use case cited in the explainer: a relay that forwards APDUs between a remote session and the host's local card reader. End-to-end pipeline visualisation.

  3. APDU builder

    An ISO 7816-4 APDU encoder + decoder you can use without a card. Build CLA/INS/P1/P2/data/Le; see the wire-format hex; decode response status words. Six presets including SELECT, READ BINARY, VERIFY PIN, INTERNAL AUTHENTICATE.

  4. PIV Card Reader

    An animated smart-card chip UI with Insert/Eject buttons, PIV AID SELECT simulation, and a four-object GET DATA picker (certificate, CCC, facial image, CHUID) with hex dump and parsed TLV field labels. PIN VERIFY simulation shows retry counter responses (SW 63 Cn) and block state (SW 69 83). A real navigator.smartCard.requestContext() call chain runs with feature detection.

why it shipped

While there are other APIs that provide the right level of abstraction and security properties for identity on the Web, such as WebAuthn, there are domain-specific functions which can't be captured by such higher-level APIs. A remote access (aka "remote desktop") web app letting the remote machine access the host's card reader as if it were directly connected to it. Enabling PC/SC applications on that remote machine to work without modification, unaware that the card reader is not local. A web-based kiosk could read even simple RFID badges via PC/SC and then display relevant information

references