title: Architectures to access Smart Card from a generic browser? Or: How to bridge the gap from browser to PC/SC stack?
body: <p>What are the possible client-side architectures to access a local Smart Card from a generic browser (connected to a server through http(s)), preferably from Javascript, with the minimum installation hassle for the end user? The server needs to be able to at least issue APDUs of its choice to the card (or perhaps delegate some of that to client-side code that it generates). I am assuming availability on the client side of a working PC/SC stack, complete with Smart Card reader. That's a reasonable assumption at least on Windows since XP, modern OS X and Unixes.</p>
  <p>I have so far identified the following options:</p>
  <ol>
  <li>Some custom ActiveX. That's what my existing application uses (we developed it in-house), deployment is quite easy for clients with IE once they get the clearance to install the ActiveX, but it does not match the &quot;generic browser&quot; requirement.
  <br><em>Update</em>:  ActiveX is supported mostly by the deprecated IE, including IE11; but not by Edge.</li>
  <li>Some PC/SC browser extension using the Netscape Plugin API, which seems like a smooth extension of the above. The only ready-made one I located is <a href="https://web.archive.org/web/20171127015705/http://www.sconnect.com/FAQ/" rel="nofollow noreferrer">SConnect (webarchive)</a>. It's no longer promoted (<em>Update</em>: thought still actively maintained and used late 2020 in at least <a href="https://www2.swift.com/3skey/help/sconnect.html" rel="nofollow noreferrer">one application</a>), it's API <a href="https://web.archive.org/web/20080609144547/http://www.mockup.rd-logic.com/jsdoc/00_file.html" rel="nofollow noreferrer">documentation (webarchive)</a> is no longer officially available, and it has strong ties to a particular Smart Card and reader vendor. The principle may be nice, but making such a plugin for every platform would be a lot of work.
  <br><em>Update</em>: NPAPI support is dropped by many browsers, including Chrome and Firefox.</li>
  <li>A Java Applet, running on top of Oracle's JVM (1.)6 or better, which comes with <a href="http://docs.oracle.com/javase/6/docs/jre/api/security/smartcardio/spec/javax/smartcardio/package-summary.html" rel="nofollow noreferrer"><code>javax.smartcardio</code></a>. That's fine from a functional point of view, well documented, I can live with the few known bugs, but I'm afraid of an irresistible downwards spiral regarding acceptance of Java-as-a-browser-extension.</li>
  <li>[update, Feb 2021]: This <a href="https://stackoverflow.com/a/32763770/903600">answer</a> considered the WebUSB API as a promising solution solution in 2015, then reported in 2019 that can't work or is abandoned. I made a question about it <a href="https://stackoverflow.com/q/66420229/903600">there</a>.</li>
  </ol>
  <p>Any other idea?</p>
  <p>Also: is there some way to prevent abuse of whatever PC/SC interface the browser has by a rogue server (e.g. presenting 3 wrong PINs to block a card, just for the nastiness of it; or making some even more evil things).</p>