4 ms·
The way I author my Electron apps to avoid this is to have a HTTP/Websocket server spin up at a random port, and then use that process to open an Electron windo
by bgdam 7y ago
The way I author my Electron apps to avoid this is to have a HTTP/Websocket server spin up at a random port, and then use that process to open an Electron window, with Node integration disabled.
This then becomes exactly the same as writing a web app, with anything that cannot be done by the renderer (Ex: file access) being done by the 'server'. Always wondered why this was not an officially strictly recommended way of doing this.
- asiachick 7y agoBecause not everyone is making an app that talks to the internet with Electron.
- therealdrag0 7y agoElectron comes with a renderer/server architecture out of the box? https://www.electronjs.org/docs/tutorial/application-architecture https://www.electronjs.org/docs/tutorial/application-archite...
- jorams 7y agoIt does, but: > Electron exposes full access to Node.js both in the main and the renderer process.
- yoz-y 7y agoLatency. The electron IPC is way faster than using web sockets and the ability to have node modules in the renderer makes some task actually feasible. I've worked on apps that were quite possible to do with electron but were completely out of question in more classic environments like Cordova or in Android/iOS web views.
- asveikau 7y agoCorrect me if I misread. You're leaving ports open on a customer machine, which has its own potential for security issues, even if you bind to localhost. Wasn't there a Mac app that recently got a lot of flack for this?
- mic159 7y agoJust remember that authentication and origin checking is completely up to the websocket server. Any random page in a browser can talk to your websocket cross origin, and it's up to your server to check the "Origin" header to make sure it's actually your app on the other end.
- vhvjkyhkogvv 7y agoIf you base it origin couldn't that have false positives too? Like say other, less privileged apps?
- deleted 7y ago[deleted]
- yoz-y 7y agoYes and no. Recently browsers started assuming that a response without CORS headers it unsafe unless from the same origin. So even though you can make a request if it fails preflight it will not even reach your server. You can try this by opening a console on any webpage and trying to do fetch requests or add img tags to the page that are loading resources from localhost.
- solarengineer 7y agoJust in case, you may want to listen on localhost and use MTLS or TLS+preregistration between the client and the server.
- monocasa 7y agoOr just use unix domain sockets and named pipes, and then you don't have users complaining that you've used some random port that they want to use for some reason. But really for stuff like file system access just use the node APIs, don't shuffle this stuff through any hand rolled IPC.