Question

I have this code working in C#:

var request = (HttpWebRequest)WebRequest.Create("https://x.com/service");
request.Method = "GET";

// Add X509 certificate 
var bytes = Convert.FromBase64String(certBase64);
var certificate = new X509Certificate2(bytes, password);
request.ClientCertificates.Add(certificate, "password"));

Is there any way to reproduce this request in Javascript? Third-party libraries would be fine for my purposes.

Answer 1

In browser-JavaScript there is no hope of doing anything like that.

The XMLHttpRequest interface gives you limited capabilities to customise the connection. You don’t get any opportunity to influence SSL negotiation and you don’t get the ability to make a request to a different domain than the one you’re running on (for very good security reasons).

You could get around that and use a low-level socket, with complex libraries to implement HTTPS over the top of it, except that JS doesn’t give you any access to low-level sockets either. Browser scripts just aren’t expected or trusted to do that kind of thing: again, there are some serious security issues to worry about if any web page can make you send random connections to other servers (including ones on your private local network).

HTML5 gives you WebSocket, which can be used for low-level, low-latency connections, but it is deliberately incompatible with other services, to stop you attacking them. In general, anything you want a browser to talk to, whether that’s via XMLHttpRequest, WebSocket or Flash Socket, will have to be deliberately set up to listen for browsers.