Explains Tauri IPC (Inter-Process Communication) patterns, including brownfield and isolation approaches for secure message passing between frontend and Rust backend. USE WHEN wiring commands or events between the webview and Rust, or choosing between the brownfield and isolation IPC patterns.
Explains Tauri IPC (Inter-Process Communication) patterns, including brownfield and isolation approaches for secure message passing between frontend and Rust backend. USE WHEN wiring commands or events between the webview and Rust, or choosing between the brownfield and isolation IPC patterns.
cluster
tauri
version
1.0.0
Tauri Inter-Process Communication (IPC)
This skill covers Tauri's IPC system, including the brownfield and isolation patterns for secure communication between frontend and backend processes.
Overview
Tauri implements Inter-Process Communication using Asynchronous Message Passing. This enables isolated processes to exchange serialized requests and responses securely.
Why Message Passing?
Safer than shared memory or direct function access
Recipients can reject or discard malicious requests
Tauri Core validates all requests before execution
Tauri provides two IPC security patterns: Brownfield (default) and Isolation.
Brownfield Pattern
What It Is
The brownfield pattern is Tauri's default IPC approach. It prioritizes compatibility with existing web frontend projects by requiring minimal modifications.
When to Use
Migrating existing web applications to desktop
Rapid prototyping and development
Applications with trusted frontend code
Simple applications with limited IPC surface
Why Use It
Zero configuration required
Minimal changes to existing web code
Direct access to Tauri APIs
Fastest development path
Configuration
Brownfield is the default. Explicit configuration is optional:
Note: There are no additional configuration options for brownfield.
Code Example
Rust backend:
#[tauri::command]fnprocess_data(input: String) ->Result<String, String> {
// Direct processing without isolation layerOk(format!("Processed: {}", input))
}
Frontend:
import { invoke } from'@tauri-apps/api/core';
// Direct invocation - no isolation layerconst result = awaitinvoke('process_data', { input: 'test' });
Security Considerations
Frontend code has direct access to all exposed commands
No additional validation layer between frontend and backend
Supply chain attacks in frontend dependencies could invoke commands
Rely on command-level validation in Rust
Isolation Pattern
What It Is
The isolation pattern intercepts and modifies all Tauri API messages from the frontend using JavaScript before they reach Tauri Core. A secure JavaScript application (the Isolation application) runs in a sandboxed iframe to validate and encrypt all IPC communications.
When to Use
Applications with many frontend dependencies
High-security requirements
Handling sensitive data or operations
Public-facing applications
When supply chain attacks are a concern
Why Use It
Protection against Development Threats:
Validates all IPC calls before execution
Catches malicious or unwanted frontend calls
Mitigates supply chain attack risks
Provides a checkpoint for all communications
Tauri recommends using isolation whenever feasible.
How It Works
Tauri's IPC handler receives a message from frontend
Message routes to the Isolation application (sandboxed iframe)
Isolation hook validates and potentially modifies the message
Message encrypts using AES-GCM with runtime-generated keys
Encrypted message returns to IPC handler
Encrypted message passes to Tauri Core for decryption and execution
Key Security Features:
New encryption keys generated on each application launch
