Security

• Types

• Commands

• Events

Types

Generally, you do not need to instantiate CDP types yourself. Instead, the API creates objects for you as return values from commands, and then you can use those objects as arguments to other commands.

class CertificateId

An internal certificate ID value.

class MixedContentType(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

A description of mixed content (HTTP resources on HTTPS pages), as defined by https://www.w3.org/TR/mixed-content/#categories

BLOCKABLE = 'blockable'

OPTIONALLY_BLOCKABLE = 'optionally-blockable'

NONE = 'none'

class SecurityState(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

The security level of a page or resource.

UNKNOWN = 'unknown'

NEUTRAL = 'neutral'

INSECURE = 'insecure'

SECURE = 'secure'

INFO = 'info'

INSECURE_BROKEN = 'insecure-broken'

class CertificateSecurityState(protocol, key_exchange, cipher, certificate, subject_name, issuer, valid_from, valid_to, certificate_has_weak_signature, certificate_has_sha1_signature, modern_ssl, obsolete_ssl_protocol, obsolete_ssl_key_exchange, obsolete_ssl_cipher, obsolete_ssl_signature, key_exchange_group=None, mac=None, certificate_network_error=None)

Details about the security state of the page certificate.

protocol: str

Protocol name (e.g. “TLS 1.2” or “QUIC”).

key_exchange: str

Key Exchange used by the connection, or the empty string if not applicable.

cipher: str

Cipher name.

certificate: List[str]

Page certificate.

subject_name: str

Certificate subject name.

issuer: str

Name of the issuing CA.

valid_from: TimeSinceEpoch

Certificate valid from date.

valid_to: TimeSinceEpoch

Certificate valid to (expiration) date

certificate_has_weak_signature: bool

True if the certificate uses a weak signature algorithm.

certificate_has_sha1_signature: bool

True if the certificate has a SHA1 signature in the chain.

modern_ssl: bool

True if modern SSL

obsolete_ssl_protocol: bool

True if the connection is using an obsolete SSL protocol.

obsolete_ssl_key_exchange: bool

True if the connection is using an obsolete SSL key exchange.

obsolete_ssl_cipher: bool

True if the connection is using an obsolete SSL cipher.

obsolete_ssl_signature: bool

True if the connection is using an obsolete SSL signature.

key_exchange_group: Optional[str] = None

(EC)DH group used by the connection, if applicable.

mac: Optional[str] = None

TLS MAC. Note that AEAD ciphers do not have separate MACs.

certificate_network_error: Optional[str] = None

The highest priority network error code, if the certificate has an error.

class SafetyTipStatus(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

BAD_REPUTATION = 'badReputation'

LOOKALIKE = 'lookalike'

class SafetyTipInfo(safety_tip_status, safe_url=None)

safety_tip_status: SafetyTipStatus

Describes whether the page triggers any safety tips or reputation warnings. Default is unknown.

safe_url: Optional[str] = None

The URL the safety tip suggested (“Did you mean?”). Only filled in for lookalike matches.

class VisibleSecurityState(security_state, security_state_issue_ids, certificate_security_state=None, safety_tip_info=None)

Security state information about the page.

security_state: SecurityState

The security level of the page.

security_state_issue_ids: List[str]

Array of security state issues ids.

certificate_security_state: Optional[CertificateSecurityState] = None

Security state details about the page certificate.

safety_tip_info: Optional[SafetyTipInfo] = None

The type of Safety Tip triggered on the page. Note that this field will be set even if the Safety Tip UI was not actually shown.

class SecurityStateExplanation(security_state, title, summary, description, mixed_content_type, certificate, recommendations=None)

An explanation of an factor contributing to the security state.

security_state: SecurityState

Security state representing the severity of the factor being explained.

title: str

Title describing the type of factor.

summary: str

Short phrase describing the type of factor.

description: str

Full text explanation of the factor.

mixed_content_type: MixedContentType

The type of mixed content described by the explanation.

certificate: List[str]

Page certificate.

recommendations: Optional[List[str]] = None

Recommendations to fix any issues.

class InsecureContentStatus(ran_mixed_content, displayed_mixed_content, contained_mixed_form, ran_content_with_cert_errors, displayed_content_with_cert_errors, ran_insecure_content_style, displayed_insecure_content_style)

Information about insecure content on the page.

ran_mixed_content: bool

Always false.

displayed_mixed_content: bool

Always false.

contained_mixed_form: bool

Always false.

ran_content_with_cert_errors: bool

Always false.

displayed_content_with_cert_errors: bool

Always false.

ran_insecure_content_style: SecurityState

Always set to unknown.

displayed_insecure_content_style: SecurityState

Always set to unknown.

class CertificateErrorAction(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)

The action to take when a certificate error occurs. continue will continue processing the request and cancel will cancel the request.

CONTINUE = 'continue'

CANCEL = 'cancel'

Commands

Each command is a generator function. The return type Generator[x, y, z] indicates that the generator yields arguments of type x, it must be resumed with an argument of type y, and it returns type z. In this library, types x and y are the same for all commands, and z is the return type you should pay attention to. For more information, see Getting Started: Commands.

disable()

Disables tracking security state changes.

Return type:

Generator[Dict[str, Any], Dict[str, Any], None]

enable()

Enables tracking security state changes.

Return type:

Generator[Dict[str, Any], Dict[str, Any], None]

handle_certificate_error(event_id, action)

Handles a certificate error that fired a certificateError event.

Deprecated since version 1.3.

Parameters:

• event_id (int) – The ID of the event.

• action (CertificateErrorAction) – The action to take on the certificate error.

Return type:

Generator[Dict[str, Any], Dict[str, Any], None]

Deprecated since version 1.3.

set_ignore_certificate_errors(ignore)

Enable/disable whether all certificate errors should be ignored.

Parameters:

ignore (bool) – If true, all certificate errors will be ignored.

Return type:

Generator[Dict[str, Any], Dict[str, Any], None]

set_override_certificate_errors(override)

Enable/disable overriding certificate errors. If enabled, all certificate error events need to be handled by the DevTools client and should be answered with handleCertificateError commands.

Deprecated since version 1.3.

Parameters:

override (bool) – If true, certificate errors will be overridden.

Return type:

Generator[Dict[str, Any], Dict[str, Any], None]

Deprecated since version 1.3.

Events

Generally, you do not need to instantiate CDP events yourself. Instead, the API creates events for you and then you use the event’s attributes.

class CertificateError(event_id, error_type, request_url)

There is a certificate error. If overriding certificate errors is enabled, then it should be handled with the handleCertificateError command. Note: this event does not fire if the certificate error has been allowed internally. Only one client per target should override certificate errors at the same time.

Deprecated since version 1.3.

event_id: int

The ID of the event.

error_type: str

The type of the error.

request_url: str

The url that was requested.

class VisibleSecurityStateChanged(visible_security_state)

EXPERIMENTAL

The security state of the page changed.

visible_security_state: VisibleSecurityState

Security state information about the page.

class SecurityStateChanged(security_state, scheme_is_cryptographic, explanations, insecure_content_status, summary)

The security state of the page changed. No longer being sent.

Deprecated since version 1.3.

security_state: SecurityState

Security state.

scheme_is_cryptographic: bool

True if the page was loaded over cryptographic transport such as HTTPS.

explanations: List[SecurityStateExplanation]

Previously a list of explanations for the security state. Now always empty.

insecure_content_status: InsecureContentStatus

Information about insecure content on the page.

summary: Optional[str]

Overrides user-visible description of the state. Always omitted.