Access node-based modules in renderer process securely

Question

After reading Electron's security tutorial, I disabled nodeIntegeration and enabled contextIsolation when creating my instance of BrowserWindow. This has the effect that the renderer cannot load modules that depend on NodeJS APIs (such as require()). So, for example, I am unable to use electron-store (or electron for that matter).

This also means that I am unable to use IPC, even though I wouldn't be able to use IPC anyway because it JSON serializes my custom objects, which essentially causes object slicing by converting my custom object into a POJO.

With that said, what is the correct way to securely communicate between the main process and the renderer process. I want to create a Singleton app instance in my main process, access it in the renderer process (e.g., load configuration from disk, and then allow the user to view/edit it from the renderer, save the changes back to disk) as securely as possible.

I have looked at some other similar topics (e.g., like this one) and it still doesn't work; besides, even if it worked, it's a hack and I'd like to avoid hacks if there are better ways that I'm just not finding on my own.

customcommander customcommander · Accepted Answer · 2019-01-27T08:36:59

It depends where your content comes from. The security tutorial rightly points out that one should take extra care when loading remote content:

Any resources not included with your application should be loaded using a secure protocol like HTTPS ¹

If the content of your renderer process is packaged with your application, I think you can be a bit more relaxed about it:

function createWindow () {
  mainWindow = new BrowserWindow({width: 800, height: 600});
  mainWindow.loadFile('index.html');
}

In my case (YMMV) the index.html file isn't loaded from HTTPS but from the file system. That file is part of my codebase and shipped with the app itself and I can trust everything in it.

Access node-based modules in renderer process securely

1 Answers