Secure contexts

A secure context is a Window or Worker for which certain minimum standards of authentication and confidentiality are met. Many Web APIs and features are accessible only in a secure context. The primary goal of secure contexts is to prevent MITM attackers from accessing powerful APIs that could further compromise the victim of an attack.

Why should some features be restricted?

Some APIs on the web are very powerful, giving an attacker the ability to do the following and more:

  • Invade a user's privacy.
  • Get low-level access to a user's computer.
  • Get access to data such as user credentials.

When is a context considered secure?

A context is considered secure when it meets certain minimum standards of authentication and confidentiality defined in the Secure Contexts specification. A particular document is considered to be in a secure context when it is the active document of a top-level browsing context (basically, a containing window or tab) that is a secure context.

For example, even for a document delivered over TLS within an