For Chrome, an API for direct TCP and UDP communications is being developed.

Google Inc. has begun implementing a new API in Chrome Raw Sockets, allowing web applications to establish direct network connections using TCP and UDP protocols. In 2015, the W3C consortium already attempted to standardize the 'TCP and UDP Socket', but the working group members did not reach a consensus, and the development of this API was halted.

The need for adding a new API is justified by the opportunity to interact with network devices that use their own protocols operating over TCP and UDP, and do not support interaction via HTTPS or WebSockets. It is noted that the Raw Sockets API will complement existing low-level programming interfaces in the browser, such as WebUSB, WebMIDI, and WebBluetooth, allowing interaction with local devices.

To mitigate negative security impacts, the Raw Sockets API will allow network requests only initiated with user consent and limited to a list of user-approved hosts. The user will have to explicitly confirm the first connection attempt for a new host. By using a special flag, the user can disable the repeat request confirmation prompts for subsequent connections to the same host. To prevent DDoS attacks, the frequency of requests through Raw Sockets will be limited, and sending requests will only be possible after user interaction with the page. UDP packets received from hosts not approved by the user will be ignored and will not reach the web application.

The initial implementation does not provide for creating listening sockets, but in the future, it is not ruled out that calls for accepting incoming connections from localhost or a list of known hosts may be provided. There is also a mention of the need to protect against 'DNS rebinding' (an attacker can change the IP address for a user-approved domain name at the DNS level and gain access to other hosts). Access to domains resolving to 127.0.0.0/8 and intranet networks is expected to be blocked (requests to localhost are proposed to be allowed only when the IP address is explicitly entered in the confirmation form).

Among the risks that may arise when implementing a new API is its potential rejection by other browser vendors, which could lead to compatibility issues. The developers of Mozilla Gecko and WebKit have not yet taken a position on the possible implementation of the Raw Sockets API, but Mozilla had previously proposed a similar API. If approved at the initial stage, the Raw Sockets API is planned to be activated in Chrome OS, and only afterward offered to Chrome users on other systems.

Web developers have responded positively to the new API, expressing many new ideas about its application in areas where the XMLHttpRequest, WebSocket, and WebRTC APIs are insufficient (ranging from creating browser clients for SSH, RDP, IMAP, SMTP, IRC, and printing protocols to developing distributed P2P systems with DHT (Distributed Hash Table), supporting IPFS, and interacting with specific IoT device protocols).

Source: opennet.ru