Search code examples
browserpcscwebusb

WebUSB API and PC/SC Smart Card readers


Is it within the scope of the WebUSB API (drafted there) to be able to use PC/SC devices such as Smart Card readers, perhaps under the assumption they are CCID-compliant (many are close to that and do work with a generic driver)?

If yes, is there any proof-of-concept code showing how, and with what modern browser and reader combination can it run?


This is a followup to this 2013 question. I'm trying to find the status of the WebUSB API solution proposed in this answer.


Solution

  • Connecting to smart card readers is outside the scope of the WebUSB API. The reason for this is that the security properties of smart cards make it inappropriate to allow arbitrary code to access them. There is too great a risk of phishing attacks.

    The WebAuthn API has built-in protections against this type of attack and is the preferred method to interface with security hardware.