Skip to content

Add note on remembering previously allowed ports (#107) #226

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
gregstoll wants to merge 1 commit into
base: main
Choose a base branch
from
+11 −0
Open

Add note on remembering previously allowed ports (#107) #226

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -400,6 +400,17 @@ <h3>
ports which the user has allowed the site to access
as the result of a previous call to {{Serial/requestPort()}}.
</li>
<div class="note">
An implementation is allowed to have a storage mechanism that
remembers ports that have been allowed from previous calls of
{{Serial/requestPort()}} from previous times the user has
visited the same site. Implementations should take caution that
a device will not always have the same port name, as this is up
to the operating system, and thus there is a danger that
allowing access to a previously allowed port may grant access
to a different device than the user intended. As such,
implementations should communicate this risk to the user.
Comment on lines +407 to +412
Copy link
Copy Markdown
Collaborator

@reillyeon reillyeon Apr 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From our implementation experience in Chromium we've found that on Windows the situation is actually pretty good and we use the "device instance ID" to identify ports. Internally Windows generates this ID using a combination of device identifiers and bus topology information. On other platforms we make the more conservative assumption that device names (e.g. /dev/ttyUSB0 or /dev/tty.usbserial0) are not stable and only persist permissions for USB devices where we have a USB vendor ID, product ID and serial number to match.

I would probably rephrase this as,

Implementations should take caution that OS-provided device names may or may not allow accurate reidentification of a device between sessions and should only use properties which are highly likely to identify a specific device when remembering a user's permission decision. When no such identifier is present the permission should be time or session-limited.

</div>
<li>Let |ports| be the sequence of the {{SerialPort}}s
representing the ports in |availablePorts|.
</li>
Expand Down
Loading