advanced-patterns

Advanced Patterns for Electron Development

Directives for building complex, scalable Electron applications. Apply when implementing multi-window apps, typed IPC, plugins, or enterprise-level features.

---

Security Best Practices

• Context isolation: Always enable contextIsolation: true and nodeIntegration: false in webPreferences
• Preload scripts: Expose only the minimal API surface via contextBridge.exposeInMainWorld; never expose raw ipcRenderer or require
• CSP: Implement strict Content Security Policy headers; restrict script sources to trusted domains; use nonces or hashes for inline scripts when unavoidable
• IPC validation: Validate all IPC messages (type, format, length) before processing; reject invalid payloads explicitly
• Origin verification: Verify message origin for sensitive IPC channels
• For detailed security guidance (auth, encryption, input validation), defer to security.mdc and engineering-security.mdc

// Minimal BrowserWindow security
webPreferences: { nodeIntegration: false, contextIsolation: true, preload: path.join(__dirname, 'preload.js') }

---

Multi-Window Management

• Use a centralised window manager — a single module or class that owns creation, lookup, and teardown of all BrowserWindow instances
• Persist window state (bounds, maximised/minimised) on close; restore on reopen; ensure restored bounds stay within screen
• Cleanup on close: Remove windows from the manager map on closed; clear references to avoid leaks
• Unique IDs: Assign a stable ID per window; use it for IPC routing and state persistence
• Parent-child relationships: Set parent where appropriate; ensure child windows close with parent
• Do not create windows ad hoc from multiple places; route all creation through the manager

---

Advanced IPC Patterns

• Typed request-response: Use a request ID, correlate responses, and support invoke-style async calls; avoid fire-and-forget for operations that need a result
• Timeout handling: Set a timeout (e.g. 5s) for each request; reject and clean up pending requests on timeout
• Batching: For high-frequency IPC, consider batching multiple operations into a single round-trip where latency allows
• Validation: Validate payload shape and size before processing; return structured errors (code, message) rather than raw exceptions
• Channel naming: Use a consistent naming scheme (e.g. module:action) and document the contract
• Define shared TypeScript interfaces for request/response shapes in a shared/types module