Orqestria Download
← Back to Desktop app developers

Skill · Version 1.0.0

Secure desktop boundaries

Constrains the bridge between desktop web content and native capabilities, including local servers that other applications may reach.

secure-ipc-native-boundaries

Team members using this skill

See how it helps

When is it useful?

Use it when exposing filesystem, process or host operations to Electron or Tauri interfaces.

What does it help you do?

  • Exposes narrow typed IPC commands instead of raw shell primitives.
  • Restricts renderer privileges, navigation and native capability scopes.
  • Authenticates localhost APIs rather than trusting loopback addresses.

Try asking this

Review a desktop preview’s access to native files and its local HTTP server. Load untrusted preview content and attempt an arbitrary file-read command. The native boundary must reject it, and unauthenticated localhost requests must not gain access.

Detailed documentation

Read the skill’s original instructions, examples and checks in their authored language.

Details…Show less

Secure IPC & Native Boundaries

In a desktop app, XSS or untrusted content in the UI can escalate to full arbitrary code execution on the user's machine if the boundary between the web renderer and native OS capabilities is porous. Enforce strict capability isolation at every IPC and local network boundary.

Narrow, Typed IPC Contracts (Never Expose Raw Primitives!)

Forbidden Anti-Pattern Secure Pattern
Exposing raw ipcRenderer, fs, child_process, or shell.openExternal directly to window Expose narrow, domain-specific methods (window.desktop.selectProjectFolder(), window.desktop.openExternalDoc(docId)) via contextBridge.exposeInMainWorld or typed Tauri invoke commands
Generic file/command RPC (invoke('fs:read', arbitraryPath) or invoke('exec', cmdString)) Validate paths against user-approved dialog selections or scoped workspace roots (fs.realpath + boundary check); allowlist specific commands and pass argument arrays
Trusting every IPC call blindly in the main/Rust process Validate event.senderFrame.origin (Electron) or window/webview capability scopes (Tauri v2 src-tauri/capabilities/*.json), and validate all arguments with a strict schema

Mandatory Renderer & WebView Hardening

  1. Electron BrowserWindow Security Baseline:
    • Always enforce contextIsolation: true, sandbox: true, nodeIntegration: false, and webSecurity: true.
    • Intercept and block unexpected navigation and popups in the main process:
      • On contents.on('will-navigate', (event, url) => ...): block any navigation away from your app's own local origin.
      • On contents.setWindowOpenHandler(({ url }) => ...): deny new privileged BrowserWindow creation and route only explicitly allowlisted https: URLs to the system browser.
  2. Tauri v2 Capability & Scope Least Privilege:
    • Grant capabilities per window in src-tauri/capabilities/default.json.
    • Scope tauri-plugin-fs to explicit $APPDATA or user-selected directories (scope.allow_directory(...)) with deny rules on sensitive config/credential files, and restrict tauri-plugin-shell to declared sidecars or strict argument validators.

Securing Embedded Localhost HTTP / WebSocket Servers

When the desktop app runs a local HTTP/WebSocket backend on 127.0.0.1:<port>:

  • Never treat 127.0.0.1 as sufficient authentication: Any website open in the user's normal browser—or another local process—can send requests to http://127.0.0.1:<port>.
  • Mandatory loopback defenses:
    1. Bind strictly to 127.0.0.1 (never 0.0.0.0).
    2. Generate a high-entropy per-launch or owner-only (0600) bearer token and require it on every API and WebSocket request.
    3. Reject foreign Host headers (preventing DNS rebinding attacks) and reject foreign Origin headers.

Included files 1

  • SKILL.md