WPT details: The pseudo-wpt test is implemented here chrome/test/data/controlled_frame/webrequest_read.window.js. Command to run it - `autoninja -C out/Default browser_tests && out/Default/browser_tests --gtest_filter=ControlledFrameWptBrowserTest.Run/webrequest_read` - pseudo-wpt is a historical artifact of parent feature controlled frame. More info is in the Web Platform Tests section https://chromestatus.com/feature/5199572022853632?gate=5134483605422080 - this test only supports `state="secure"`, because endpoint with invalid certificate is not possible to use in wpt environment. There's more complete browser tests which covers all possible cases and states: chrome/browser/extensions/api/web_request/web_request_apitest.cc gtest_filter=ExtensionWebRequestApiTest.SecurityInfo*, SecurityInfoBrokenWebRequestApiTest.*
This feature introduces a WebRequest.SecurityInfo API for [ControlledFrame](https://developer.chrome.com/docs/iwa/controlled-frame). It allows a web app to intercept an HTTPS, WSS, or WebTransport request to a server, retrieve the server's certificate fingerprint (as verified by the browser), and then use that fingerprint to manually verify the certificate of a separate raw TCP/UDP connection to the same server. This provides a simple way for the app to confirm it's communicating with the correct server.
Web apps sometimes need to establish secure raw TCP/UDP connections (e.g., via Direct Sockets) for custom protocols, often to support legacy servers that cannot be updated to modern alternatives like WebTransport. Unlike standard HTTPS, these raw sockets don't have a built-in mechanism to verify the server's TLS certificate against a trusted root store. This proposal introduces a WebRequest SecurityInfo API for ControlledFrame (https://chromestatus.com/feature/5199572022853632). It allows a web app to intercept an HTTPS, WSS or WebTransport request to a server, retrieve the server's certificate fingerprint (as verified by the browser), and then use that fingerprint to manually verify the certificate of a separate raw TCP/UDP connection to the same server. This provides a simple way for the app to confirm it's talking to the correct server.
Docs: https://github.com/explainers-by-googlers/security-info-web-request
Explainers: https://github.com/explainers-by-googlers/security-info-web-request