Chrome 89 launched WebHid API with limitations for security.

Limitations includes:

1. Javascript cannot receive USB Hid data when browser tab switched.

2. Javascript cannot receive USB Hid data when user is opening select html element

..... more in the link

There is a commit in Chromium project says that The blocklist may be bypassed by passing allow_protected_reports=true when connecting to the devic.

Is there a way to set allow_protected_reports=true to bypass these limitations on UI such as chrome://flags?

related link: https://web.dev/hid/#security-privacy

2021.10.28 update

MacOS BigSur 11.2.3

Chrome Version 95.0.4638.54 (Official Build) (x86_64)

For reproducing the limitation:

1. Javascript cannot receive USB Hid data when user is opening select html element

   <select>
      <option> test </option>
    </select>

device.addEventListener("inputreport", (e) => {
        const data = e.data.buffer;
        console.log(new Date(), "received data", data);
      });

When the user click the "test" select element to open it, it will stop receiving data.

working example on codesandbox

2. Javascript cannot receive USB Hid data when browser tab switched.

I cannot reproduce it every time on my mac chrome now, I did receiving hid device data via API device.addEventListener("inputreport",...) in a simple testing environment when the tab switched. But I found it stopped in my real production React.js application which running much more javascript and timers ( setInterval ).

CodePudding user response：

No, there's no chrome://flags flag for bypassing the HID blocklist and we don't plan on adding one due to the risk. The allow_protected_reports flag is used by Chrome's internal HID clients and should never be enabled for Javascript clients. (If script could access protected reports then it becomes trivial to implement keyloggers to capture passwords and other private information.)

If you feel the HID blocklist is blocking something it shouldn't, please edit your question to share more information about the devices you're trying to access. You can also file a bug on the WebHID spec tracker where the blocklist is hosted.

Javascript cannot receive USB Hid data when browser tab switched.

This isn't intentional, we expect applications will need background access to HID devices in order to function correctly when the tab isn't visible. Can you edit your question to add more information about the OS (and OS version) you tested this on? (Or file a Chromium bug)

Javascript cannot receive USB Hid data when user is opening select html element

I'm not sure what this means, can you provide a test case demonstrating the issue?