Will an Electron based app pass system wide nodejs environment variables?

0
votes

Am I wrong to assume that an Electron based application will pass NodeJS environment variables?

The app we are dealing with is built upon Electron 3.1.x. The list of environment variables for electron 3.1.x seem to work. However, if I try to use any of the environment variables listed in NodeJS (notably NODE_EXTRA_CA_CERTS or NODE_TLS_REJECT_UNAUTHORIZED) they don't seem to work. I was under the impression that since Electron is simply a nodejs application, that it would respect the same environment variables.

1
node.jselectron

1 Answers

3
votes

Yes and no. Env vars are of course available to app code (process.env), and electron itself supports some (but not all) NODE_* vars.

It's important to remember that electron is node and Chrome bolted together. Of particular relevance to HTTP requests, this means that electron actually has two parallel HTTP implementations: the browser (fetch/XHR) and node's (require('http')).

Thus, if HTTP requests are going through the browser plumbing, the NODE_* variables have no effect, and conversely, requests made through the node plumbing are not affected by Chrome flags.

There are additional quirks:

  • By default, Chrome will use the system's HTTP proxy settings; node does not
  • By default, Chrome will use the system's root CA certificate store; node uses a builtin list
  • Requests made through browser plumbing are visible in the electron Dev Tools' Network tab; node requests are not

So:

  • To ignore TLS cert errors everywhere, you must set NODE_TLS_REJECT_UNAUTHORIZED=0 and at the very beginning of main.js, call app.commandLine.appendSwitch('ignore-certificate-errors'). Of course, disabling cert errors across the board is dangerous for obvious reasons.
  • For browser plumbing to trust a self-signed certificate, you should add it to your system's CA store (Windows certmgr, OS X Keychain, Linux NSS).

  • Unfortunately, NODE_EXTRA_CA_CERTS is broken in electron, so getting the node plumbing to trust a self-signed cert is difficult. This comment suggests monkey patching NativeSecureContext.prototype.addRootCerts to work around the issue. You could also try monkey patching https.globalAgent.

    Either way, I don't believe there is a way to get a cert trusted without modifying app code.

You'll likely need to modify the app JS to get this working. If you're dealing with a distributed app, asar extract will likely be of interest.