Web Serial API

To mitigate risks related to unauthorized access to sensitive data and device fingerprinting, the Bluetooth RFCOMM implementation for Web Serial follows these security principles:

• Permission Gating: Access to device information and communication is gated behind a user-initiated permission prompt. No device information is exposed until the user selects a specific device.
• Service Filtering: To prevent access to sensitive standard Bluetooth profiles (like the Phone Book Access Profile or GPS/GNSS profiles), the API blocks access to all standard Bluetooth Classic service class UUIDs except for the Serial Port Profile.
• Identifier Protection: The API does not expose the Bluetooth device address in SerialPortInfo to prevent active fingerprinting.
• Context Restriction: Access is restricted to first-party contexts by default using Feature Policy. Third-party contexts (like iframes) must be explicitly granted access using the allow="serial" attribute.

Using Serial via Bluetooth Classic inherits all security risks associated with the standard Web Serial API. The primary security model relies on a permissions system where a user must explicitly grant access to a device, and the device must already have a bonding relationship with the host computer.

Security Mitigations

User agents may implement the following to mitigate risks, particularly regarding non-standard Bluetooth services:

• Service Filtering: Blocking all Bluetooth specified services except for SPP (Serial Port Profile). Only vendor-defined service class IDs are exposed to Web Serial.
• Enterprise Policy: Administrators may disable non-standard serial port services via policy.
• UUID Blocklists: Browsers may block specific UUIDs to prevent hardware-level exploits.

Privacy Considerations

Web pages can potentially determine the class of a connected device by filtering for UUIDs or calling SerialPort.getInfo(). To protect privacy, a page cannot enumerate device attributes without first being explicitly granted access to a Bluetooth serial device that is currently bonded to the host.

The Serial API follows a security model similar to Web Bluetooth and WebUSB to mitigate risks such as malicious firmware installation or device exploitation. To use the API, your application must adhere to the following requirements:

1. Secure Origin

The page must be served from a secure origin (HTTPS) to prevent network-based code injection.

2. Permission Model

Access to devices is not automatic. You must use requestPort() to trigger a user-facing prompt. The user must actively select a specific device to grant access. This prevents 'drive-by' attacks where a site attempts to access hardware without user interaction.

3. Cross-Origin Restrictions

Cross-origin iframes are prohibited from using the Serial API unless the embedding page explicitly grants permission via Feature Policy.

4. Privacy and Device Identification

Once a user grants access to a device, the site may be able to access identifiers such as:

• Vendor and Product IDs (for USB/Bluetooth devices).
• Serial numbers or MAC addresses.
• Data returned via serial commands.

Because the user agent cannot inspect the opaque data sent over the serial line, the primary privacy defense is the permission model, which ensures a site cannot proactively enumerate available devices without user consent (similar to the File Picker API).

After opening a port, the readable and writable attributes are populated with ReadableStream and WritableStream objects. You can use TextEncoder and TextDecoder to handle ASCII/string data, or TextEncoderStream and TextDecoderStream for a more streamlined approach using pipeTo().

Manual Encoding/Decoding

const encoder = new TextEncoder();
const writer = port.writable.getWriter();
writer.write(encoder.encode("AT"));

const decoder = new TextDecoder();
const reader = port.readable.getReader();
const { value, done } = await reader.read();
console.log(decoder.decode(value));

Using TransformStreams (Recommended for text)

const encoder = new TextEncoderStream();
const writableStreamClosed = encoder.readable.pipeTo(port.writable);
const writer = encoder.writable.getWriter();
writer.write("AT");

const decoder = new TextDecoderStream();
const readableStreamClosed = port.readable.pipeTo(decoder.writable);
const reader = decoder.readable.getReader();
const { value, done } = await reader.read();
console.log(value);

// Manual approach
const encoder = new TextEncoder();
const writer = port.writable.getWriter();
writer.write(encoder.encode("AT"));

const decoder = new TextDecoder();
const reader = port.readable.getReader();
const { value, done } = await reader.read();
console.log(decoder.decode(value));