v147 · SecurityInfo Inspector

SecurityInfo Inspector

The webRequest.onHeadersReceived listener inside a Controlled Frame can receive details.securityInfo when the listener requests securityInfo or securityInfoRawDer. Select a simulated response to see whether an IWA has enough browser-verified certificate data to pin a Direct Socket.

Controlled Frame context required. webRequest with securityInfo is available inside an Installed Web App (IWA) that embeds a <controlledframe>. This demo simulates the securityInfo payloads and shows the grading logic.

Simulated SecurityInfo scenarios

securityInfo fields
Pinning verdict
A
Excellent
// Controlled Frame — webRequest securityInfo (Chrome 147)
controlledFrame.addEventListener('contentload', () => {
  controlledFrame.request.onHeadersReceived.addListener(
    (details) => {
      const sec = details.securityInfo;
      if (!sec) return;

      console.log(sec.state);          // 'secure' | 'insecure' | 'broken'
      console.log(sec.certificates);   // array of CertificateInfo
      console.log(sec.certificates[0].fingerprint.sha256);
      // → pin the Direct Socket only when state is secure
    },
    { urls: ['<all_urls>'] },
    ['securityInfo']
  );
});

references