Detect Chrome switch allow-running-insecure-content from a webpage - asp.net

Question

I have a SSO login page built in ASP.NET where I authenticate users and then pass them onto another system. This other system, for unknown reasons, requires that Chrome be running with the switch --allow-running-insecure-content in order for some external peripheral devices to run with their website.
My customer is wanting to ensure the current Chrome browser instance is running with this flag/switch set, and if not to display an error/warning message.
Is there any way of detecting this within Chrome itself from ASP.NET? Or, perhaps a way to simulate loading a resource that requires the switch to be set, and then detecting if that resource loaded or not?

Answer 1

Yes, there is a way from the client-side to detect whether Chrome is running with --allow-running-insecure-content.
The trick is to add an insecure resource to the web page and then check to see if that resource was loaded using JavaScript. Using its normal security parameters, Chrome will not load insecure resources from a secure context.
Here's some sample code that does this:
HTML:
<!-- When Chrome is run in insecure mode, as desired, this message will be removed -->
<div class="not-insecure-warning">
Your browser is not configured properly. You must access this page with Chrome using <code>--allow-running-insecure-content</code>. Learn more.
</div>
JavaScript:
// Remove `.not-insecure-warning` elements
function removeNotInsecureWarning(){
var warnings = document.getElementsByClassName('not-insecure-warning');
for(var i = 0; i < warnings.length; i++){
var warning = warnings[i];
warning.parentNode.removeChild(warning);
}
}
var insecureScript = document.createElement('script');
// TODO: Replace URL to an empty `.js` file served over HTTP
insecureScript.src = 'http://code.jquery.com/jquery-3.2.1.js';
// If this insecure script loads, then the browser is running in insecure mode, remove the warning
insecureScript.addEventListener('load', removeNotInsecureWarning);
document.body.append(insecureScript);
See this example on JSFiddle. You should see the warning if you're running Chrome normally, but if you open a new window with insecure content allowed, the warning on this page will disappear.
If you need to pass this information to your server-side logic, you can either:
Use AJAX. Send an XMLHttpRequest if the insecure script fails to load using an event listener like insecureScript.addEventListener('error', isSecureSendPOSTRequest);
Use a hidden form input <input name="is_insecure" type="hidden" value="0"> that you can process immediately after the user logs-in. You can toggle the value of this input using the same kind of client-side logic shown above.

Answer 2

I don't know about a direct solution , but a possible solution is that you can open chrome using the shell script in the c# as follows.
class Module1 {
static void Main() {
System.Diagnostics.Process.Start("chrome.exe", "--allow-running-insecure-content");
}
}
As you want to add --allow-running-insecure-content for loading the browser with that flag