I am wondering if it's possible (and how) to make some Win32 API calls from a web browser by using JavaScript. My current understanding of this matter lead me to conclusion that I would require some kind of ActiveX control which could then be used to easily make the required calls. However the readings of articles throughout the web warn me that using ActiveX wouldn't be a cross-browser solution. Now I don't want to force my users to use only IE which is, as far as I understand, the only browser which supports ActiveX. I do want to make this feature available to Windows users only though.
What I want is to obtain the currently logged on user and his SID and send this information to web application which will process this data, store it to the database etc. Also, I will probably require some calls to access hardware encryption devices connected to the client computer (i.e. USB token with certificate).
How to obtain this? Do I need to write separate plugin for each web browser? It would be preferred if this could all be done using C#, but native C++ is not strange to me either so if the first is not possible, I could fall back to the latter.
What you are asking for is NOT possible without a browser-specific plugin that runs on the client machine itself (which an ActiveX control does).
ActiveX is primarily an InternetExplorer-only technology, however there have been plugins in the past to add ActiveX support to other browsers. Not sure any of them have survived over time. But either way, ActiveX is a Windows-only technology, so it won't work on other platforms.
The current trend in browser technology is to try moving AWAY from plugins as much as possible, relying on features built-in to HTML5 and JavaScript themselves instead.
AFAIK, the only cross-browser solution I can think of is using a signed Java applet to load a DLL via JNI:
Load .DLL with applet and use it on client
However, Java applets are not very popular anymore in lieu of Flash and HTML5, and even some browsers disable Java by default nowadays. So I don't think it is a very viable solution if you are trying to target a wide audience. But for an isolated audience, it may be a viable option.