v144 · Certificate Pinning Demo

Certificate Pinning Demo

Certificate pinning: the IWA intercepts each HTTPS request via webRequest.onHeadersReceived, reads the certificate fingerprint from securityInfo, and compares it against a stored expected value. If the fingerprint doesn't match the pin, the request is blocked — preventing man-in-the-middle attacks even against technically valid certificates.

Isolated Web Apps only. webRequest.SecurityInfo on ControlledFrame requires an IWA. This simulation walks through the exact API flow with realistic securityInfo payloads.

Choose a scenario

Implementation

// Inside an Isolated Web App using ControlledFrame
// Store the expected certificate fingerprint (SHA-256)
const PINNED_FINGERPRINT = 'A1:B2:C3:D4:...:FF'; // your server's cert fingerprint

frame.webRequest.onHeadersReceived.addListener(
  async (details) => {
    const info = await frame.webRequest.getSecurityInfo(
      details.requestId,
      { certificateChain: true, rawDER: false }
    );

    // info.certificates[0] is the leaf (server) certificate
    const leafCert = info.certificates?.[0];
    if (!leafCert) return; // no cert = HTTP, skip

    // Compare fingerprint against the stored pin
    const fp = leafCert.fingerprint.sha256;
    if (fp !== PINNED_FINGERPRINT) {
      // Fingerprint mismatch — block the request
      console.error(`Pin mismatch: expected ${PINNED_FINGERPRINT}, got ${fp}`);
      return { cancel: true };
    }

    // Pin matched — allow the request
    return {};
  },
  { urls: ['https://api.example.com/*'] },
  ['blocking', 'responseHeaders']
);
  

Choose a scenario

Implementation

see also