electron-security-hardening

name	electron-security-hardening
description	Harden an Electron app to the secure baseline — contextIsolation on, nodeIntegration off, sandbox on, a strict CSP, no remote module — and bridge to the OS through a narrow typed contextBridge backed by validated ipcMain handlers.

Electron Security Hardening

The baseline (every BrowserWindow)

new BrowserWindow({
  webPreferences: {
    contextIsolation: true, // isolate preload from renderer globals
    nodeIntegration: false, // no Node in the renderer
    sandbox: true, // OS-level renderer sandbox
    webSecurity: true, // keep same-origin enforcement
    preload: path.join(__dirname, "preload.js"),
  },
});

Plus: a strict Content-Security-Policy (no unsafe-eval, no remote script-src), no @electron/remote, block navigation to untrusted origins (will-navigate / setWindowOpenHandler), and open external links via shell.openExternal(url) only after validating the URL.

The IPC bridge (allow-list, not a pipe)

// preload.js — expose named operations, never raw ipcRenderer
const { contextBridge, ipcRenderer } = require("electron");
contextBridge.exposeInMainWorld("api", {
  readDoc: (id) => ipcRenderer.invoke("doc:read", id),
});

// main.js — validate every argument
const { ipcMain } = require("electron");
ipcMain.handle("doc:read", async (_evt, id) => {
  if (typeof id !== "string" || !/^[\w-]{1,64}$/.test(id)) throw new Error("bad id");
  return loadDoc(id);
});

When the renderer "needs Node"

Move the work to the main process behind a typed command. Never re-enable nodeIntegration to satisfy a renderer dependency.

Secrets

Use safeStorage (OS-backed encryption) for tokens; never write secrets to plaintext config. Auth flow → auth-identity.