Intent to Prototype: NDEFReader makeReadOnly()

74 views
Skip to first unread message

François Beaufort 🇫🇷

unread,
Dec 8, 2021, 1:52:34 AM12/8/21
to blink-dev

Contact emails

fbea...@google.com


Explainer

https://github.com/w3c/web-nfc/blob/gh-pages/EXPLAINER.md


Specification

https://w3c.github.io/web-nfc/#dom-ndefreader-makereadonly

https://github.com/w3c/web-nfc/pull/632


Summary

The NDEFReader makeReadOnly() method allows web developers to make NFC tags permanently read-only with Web NFC.


Blink component

Blink>NFC


Motivation

Since we’ve shipped Web NFC in Chrome 89, developers have been asking for a way to “lock” NFC tags to prevent malicious users from overwriting their content. See https://github.com/w3c/web-nfc/issues/558
This operation is a one-way process and cannot be reversed. Once an NFC tag has been made read-only, it can't be written anymore.


Web NFC restrictions apply to makeReadOnly(): It is only available to top-level frames and secure browsing contexts (HTTPS only). Origins must first request the "nfc" permission while handling a user gesture (e.g a button click). To then make the NFC tag read-only, the web page must be visible when the user touches an NFC tag with their device. The browser uses haptic feedback to indicate a tap. Access to the NFC radio is blocked if the display is off or the device is locked. When a page is placed in the background receiving and pushing NFC content is suspended.
Some additional requirements are possible, such as a separate permission for making a NFC tag read-only since it is an irreversible change.


TAG review

None yet.


TAG review status

Pending


Risks


Interoperability and Compatibility


This small addition to the NDEFReader object does not change the overall status of Web NFC interoperability or compatibility.


Signals from other implementations (Gecko, WebKit): 


Gecko: No Signal [1]

WebKit: No Signal [1]

Web / Framework developers: Positive https://twitter.com/quicksave2k/status/1465615447806681090


[1] Both Gecko and Webkit are unlikely to object to this feature specifically, but object to the overall Web NFC API as a whole, hence doesn't make sense to bug them with specific questions on this.


Activation:

This feature can't be polyfilled. It should be fairly trivial for developers to adopt this new feature.


Debuggability

Exposing DevTools debugging support for device-access APIs (Web NFC included) is discussed at https://bugs.chromium.org/p/chromium/issues/detail?id=1142566. For now, affordable NFC tags are required to debug Web NFC.


Is this feature fully tested by web-platform-tests?

Yes. This feature will be fully tested at https://wpt.fyi/results/web-nfc


Requires code in //chrome?

True if there’s new UI added. It’s not clear yet if that’s needed though.


Tracking bug

https://bugs.chromium.org/p/chromium/issues/detail?id=1275576


Estimated milestones

No milestones specified


Link to entry on the Chrome Platform Status

https://www.chromestatus.com/feature/5700853265596416


Alex Russell

unread,
Dec 8, 2021, 11:51:17 AM12/8/21
to blink-dev, François Beaufort
This is exciting!

It'd be great to see the explainer expanded with a fuller discussion of this API, which problems it solves (with example code), and a discussion of potential UI treatments.

Thanks for driving this.

Alex
Reply all
Reply to author
Forward
0 new messages