Your Browser Has Trust Issues: Why Local Devices Break Modern Web Apps

on YouTube ↗25m

" summary

Modern browsers block cloud HTTPS pages from talking to local hardware unless four security gates are satisfied: mixed content (HTTPS→HTTP blocked), CORS permissions, Local Network Access prompts, and explicit USB/user-activation consent. A concrete workaround wraps the web app in Electron so web code talks over an IPC bridge to Node.js, avoiding user-facing prompts; a deployed product, the Proxy Box, puts an HTTPS REST API in front of local devices. Real result: label printing demo goes from minutes per package to seconds and reliably prints in production.

AI-written summary · about

" chapters (7)

1. 0:00Warehouse to modern web apps
2. 7:06Browsers block local devices
3. 16:48Four security gates
4. 18:35Trust from users to devs
5. 20:03Electron for local devices
6. 22:16Live demo no warnings
7. 23:00Warehouse workers clap

" related talks

• 56mBrowser Invasion: Desktop Apps and the WebTim G. Thomas · NDC Minnesota 2018
• 55mWeb Application Security: Browsers Fight Back!Christian Wenz · NDC London 2017
• 33mA tale of two websKyle Simpson · CityJS Singapore 2023
• 55mThe Universal Serial WebSebastian Golasch · JS Fest 2019 Spring
• 59mThe Final Frontier: Security APIs in Modern BrowsersChristian Wenz · NDC Oslo 2024
• 26mEvery Process, Everywhere, All at OnceLuis Montes · SeattleJS Conf 2023
• 58mWeb Apps can’t really do *that*, can they?Steve Sanderson · NDC Oslo 2017
• 27mBuilding Cross Platform Desktop Apps With ElectronVanessa Yuen · RuhrJS 2018