v147 · Isolated Web Apps · demo

API Explorer

Step through the webRequest event lifecycle inside a ControlledFrame and inspect the SecurityInfo object available at each stage. API available in Isolated Web App context only — this page shows the interface and code patterns.

This API is only available inside Isolated Web Apps running on ChromeOS. The code examples below show the correct patterns; they cannot be executed in a regular browser tab.

event lifecycle

onBeforeRequest no SecurityInfo

Fires before the request is made. No TLS information is available yet — the connection has not been established.

frame.webRequest.onBeforeRequest.addListener(
  (details) => {
    // details.url, details.method, details.requestId
    // No certificate info available at this point
  },
  { urls: ['https://*/*'] }
);
onHeadersReceived SecurityInfo

Fires after server response headers arrive. Request the securityInfo extra info key to receive details.securityInfo; request securityInfoRawDer when raw certificate bytes are needed.

frame.webRequest.onHeadersReceived.addListener(
  (details) => {
    // details.securityInfo is available with 'securityInfo'
    const si = details.securityInfo;
    if (si) {
      console.log(si.certificates[0].fingerprint.sha256); // SHA-256 hex
    }
  },
  { urls: ['https://*/*'] },
  ['securityInfo']  // or 'securityInfoRawDer'
);
onCompleted no cert object

Fires when the response body is fully received. Use this event for completion status, but capture certificate trust data earlier from onHeadersReceived.

frame.webRequest.onCompleted.addListener(
  (details) => {
    const fp = trustedFingerprints.get(new URL(details.url).hostname);
    if (details.statusCode === 200 && fp) {
      openDirectSocket(details.url);  // proceed with stored trust anchor
    }
  },
  { urls: ['https://*/*'] }
);

SecurityInfo object

details.securityInfo — fields available with 'securityInfo' extra info key
state
string
Security state: "secure", "insecure", "weak", or "broken".
certificates
CertificateInfo[]
The browser-verified certificate list. The first item is the server certificate.
certificates[].fingerprint
object
Certificate hashes such as fingerprint.sha256, used as the trust anchor for a parallel Direct Socket.
certificates[].rawDER
ArrayBuffer
Available when securityInfoRawDer is requested; use it when raw certificate bytes must be compared.
missing extraInfoSpec
string
If neither securityInfo nor securityInfoRawDer is requested, details.securityInfo is omitted and the app must not trust the socket.

failure branches

SecurityInfo availability simulator

Choose a branch to see whether a Direct Socket may proceed.

see also

scenario focus

Select a scenario to focus its rendered example and summary.