Changes

Jump to: navigation, search

WebAPI/Security/WebNFC

3,598 bytes added, 16:13, 27 March 2015
no edit summary
https://developer.mozilla.org/en-US/docs/Web/API/NFC_API/Using_the_NFC_API <br/>
https://developer.mozilla.org/en-US/docs/Web/API/NFC_API/Using_the_NFC_emulator <br/>
 
== Gaia ==
(Review Guidelines for app reviewers)
 
Quick overview and security highlights: (see for more details about how to use the API: https://developer.mozilla.org/en-US/docs/Web/API/NFC_API/Using_the_NFC_API)
 
An app using the NFC API to interact with NFC messages has to the declare in the manifest:
the nfc permission (with readonly, readwrite or none if the app only receive data from the activity itself).
the nfc-ndef-discovered activity:
"activities": {
"nfc-ndef-discovered": {
"filters": {
"type": "url",
"url": {
"required":true, "pattern":"https?:.{1,16384}", "patternFlags":"i"
}
}
}
}
Types can be: text, text/vcard, uri, smartposter.
 
shared/js/nfc_utils.js provides methods for coding and decoding NDEF record payloads such as Wellknown, URI, Text, SmartPoster, MIME.
The handler for the nfc-ndef-discovered should filter content and match what is expected in the “type” filters defined in the manifest.
 
Thee application can get new content through NFC by the following ways:
* getting content by reading a tag:
* getting a tag: var tag = navigator.mozNfc.getNFCTag(data.sessionToken);
* getting shared contact via a mozNfcPeer:
navigator.mozNfc.onpeerready = function (evt) {
var peer = navigator.mozNfc.getNFCPeer(evt.detail);
console.log(peer instanceof MozNFCPeer); // should print true;
};
 
 
One thing to keep in mind: sharing a file with a NFC handover as explained here: https://developer.mozilla.org/en-US/docs/Web/API/NFC_API/Using_the_NFC_API#Sending_a_Blob_to_another_MozNFCPeer_by_NFC_handover
means a NFC handover between two devices will initiate a Bluetooth connection to send the file.
 
Other permissions that applications should NOT request: nfc-share, nfc-manager, nfc-hci-event
 
 
== Gecko ==
1. Receives IPC messages from NFCd
2. Broadcasts system messages to all apps (which have nfc-manager permission)
nfc-tech-discovered
nfc-tech-lost
nfc-manager-send-file
The patch also adds the following?
bluetooth-hfp-status-changed
bluetooth-sco-status-changed
 
3. IPC NFC:* messages
Parent listens to
const NFC_IPC_MSG_NAMES = [
"NFC:SendToNfcd",
"NFC:NdefDetails",
"NFC:NdefRead",
"NFC:NdefWrite",
"NFC:NdefPush",
"NFC:NfcATagDetails",
"NFC:NfcATagTransceive",
"NFC:Connect",
"NFC:Close"
];
 
Child Listens to:
const NFC_IPC_MSG_NAMES = [
"NFC:TechDiscovered",
"NFC:TechLost",
"NFC:NDEFDetailsResponse",
"NFC:NDEFReadResponse",
"NFC:NDEFWriteResponse",
"NFC:NDEFPushResponse",
"NFC:NfcATagDetailsResponse",
"NFC:NfcATagTransceiveResponse",
"NFC:ConnectResponse",
"NFC:CloseResponse"
];
 
 
 
== Gonk ==
 
== General notes about the UX/UI of NFC ==
 
Contrary to Bluetooth, the idea behind the UX of NFC if to have a “quick and easy” way to share content:
# Enable NFC
# Tap the phones
# Share content (Sharing UI)
# Display the content
 
Because phones have to be very close from each other to be able to share content, user prompts are almost not used except for the Sharing UI. Especially, a user isn’t prompted to to accept to receive the content.
In the case of URL sharing, the Browser is automatically launched to display the content hosted at the URL.
One risk could be that a user let their phone on the corner of a desk or in their pocket while NFC is enabled, and that somebody share content without them to be aware of it (in the street, in the office, etc). This is mitigated by the fact that NFC is disabled automatically when the screen is off and/or locked.
 
 
[[Category:Web APIs]]
[[Category:Security]]
Confirm
152
edits

Navigation menu