electron-crossplatform-performance

Electron Cross-Platform Performance & Architecture

Process Architecture & Isolation

Electron applications operate across distinct processes isolated by Chromium sandboxing. Enterprise applications must maintain strict process boundaries:

+-------------------------------------------------------------------------+
|                              Main Process                               |
|  - Node.js Environment (Full System Privilege)                          |
|  - Manages Application Lifecycle & Native Menus / Tray                  |
|  - Controls BrowserWindow instances & Native APIs                       |
+-------------------------------------------------------------------------+
       |                                              |
       | IPC (ContextBridge)                          | UtilityProcess API
       v                                              v
+-----------------------------+         +---------------------------------+
|     Renderer Process        |         |        Utility Process          |
|  - Chromium Web Engine      |         |  - Background Node.js Work      |
|  - Isolated DOM Rendering   |         |  - Non-blocking CPU tasks       |
|  - `nodeIntegration: false` |         |  - Heavy Data Ingestion         |
|  - `contextIsolation: true` |         +---------------------------------+
+-----------------------------+

Security Hardening & Safe IPC Design

1. Mandatory Secure BrowserWindow Configurations

Enforce strict security flags on all BrowserWindow instances:

// main/windowFactory.ts
import { BrowserWindow, app } from 'electron';
import * as path from 'path';

export function createSecureWindow(): BrowserWindow {
  const win = new BrowserWindow({
    width: 1280,
    height: 800,
    show: false, // Prevent white flashing during load
    webPreferences: {
      preload: path.join(__dirname, '../preload/index.js'),
      contextIsolation: true,       // Enforce IPC bridge separation
      nodeIntegration: false,        // Disable node access in renderer
      nodeIntegrationInWorker: false,
      sandbox: true,                 // Enable Chromium Renderer Sandbox
      webSecurity: true,             // Enforce Same-Origin Policy
      allowRunningInsecureContent: false,
    },
  });

  win.once('ready-to-show', () => {
    win.show();
  });

  // Enforce Navigation Restraints
  win.webContents.on('will-navigate', (event, url) => {
    const parsedUrl = new URL(url);
    if (parsedUrl.origin !== 'https://app.yourdomain.com' && !url.startsWith('file://')) {
      event.preventDefault();
      console.warn(`Blocked unauthorized navigation to: ${url}`);
    }
  });

  // Prevent New Windows / Popups
  win.webContents.setWindowOpenHandler(({ url }) => {
    // Open external URLs in default system browser securely
    if (url.startsWith('https:')) {
      require('electron').shell.openExternal(url);
    }
    return { action: 'deny' };
  });

  return win;
}