Secure Communication – How to Communicate Securely Between Browser and Native Application

web-applications

I am working on web application that needs data it can only get from its locally installed native application browser.

How can you get around the browser sandbox so that you can communicate (securely, since the data is potentially sensitive), with a native application.

In the only example that I found, the user manually move some tokens and files between the two, which is a horrible user experience that i would like to avoid.

Best Answer

You could embed a webserver in the native application, then your client can make calls to it via hard-coded links to http://localhost/xyz (you may have to worry about cross site scripting warnings here, and/or run the server on a non-http port). If you use websockets, your native application can even push data to the web browser once the browser has initiated communication.

I do it myself locally, an embedded webbrowser control requests visualisation data from a custom webserver and when developing I run both on the same PC.

There are many tiny and efficient embedded webservers for C/C++ (Mongoose, NxWeb, civetweb etc), C# tend to go for a full-on WCF server, python comes with a little webserver in it IIRC.

Related Topic