demo · v147 · IWA · security

TLS Certificate Audit

Reads SecurityInfo from chrome.webRequest.onHeadersReceived inside a ControlledFrame and checks whether the response has enough browser-verified certificate data to pin a Direct Socket. An overall score (0–100) summarises the pinning readiness.

Isolated Web App context required chrome.webRequest.SecurityInfo in ControlledFrame is only available to IWAs installed on ChromeOS. This page simulates the securityInfo object for well-known TLS configurations so you can explore the audit logic without an IWA context.
Simulated request:
—
?
Raw SecurityInfo object
Select a site and click Run TLS Audit.

how the audit works

  1. In a real IWA, chrome.webRequest.onHeadersReceived receives details.securityInfo when securityInfo is requested in extraInfoSpec.
  2. The audit checks the documented object shape: state, certificates[], fingerprint.sha256, and optional rawDER.
  3. Each requirement is graded independently. The overall score (0–100) is a weighted average.
  4. A score below 70 should prompt the IWA to warn the user or refuse a Direct Sockets connection to the same host.
// Inside an IWA's ControlledFrame
chrome.webRequest.onHeadersReceived.addListener(
  details => {
    const info = details.securityInfo;
    const cert = info.certificates[0];
    console.log(info.state);
    console.log(cert.fingerprint.sha256);
  },
  { urls: ['<all_urls>'] },
  ['securityInfo']
);

see also