security

Security Best Practices

Security patterns and practices for building secure Electron applications with proper input validation, authentication, and defense against common vulnerabilities.

When to Use This Skill

• Implementing authentication/authorization
• Handling user input
• Managing secrets and API keys
• Processing external data
• Reviewing code for security issues
• Setting up Electron security

Core Security Principles

Defense in Depth

Layer multiple security controls:

// Layer 1: Input validation at entry point
function handleUserInput(input: string): void {
  const validated = validateInput(input);
  
  // Layer 2: Sanitization before processing
  const sanitized = sanitizeForProcessing(validated);
  
  // Layer 3: Parameterized queries (no string concatenation)
  await db.query('SELECT * FROM items WHERE name = ?', [sanitized]);
  
  // Layer 4: Output encoding for display
  const encoded = encodeForHTML(sanitized);
}

Principle of Least Privilege

Request only necessary permissions:

// ❌ Overly permissive
mainWindow = new BrowserWindow({
  webPreferences: {
    nodeIntegration: true,  // Dangerous!
    contextIsolation: false,  // Dangerous!
  }
});

// ✅ Minimal permissions
mainWindow = new BrowserWindow({
  webPreferences: {
    nodeIntegration: false,
    contextIsolation: true,
    sandbox: true,
    webSecurity: true,
    preload: path.join(__dirname, 'preload.js'),
  }
});

Electron Security

Secure Window Configuration

// src/main/window.ts
export function createSecureWindow(): BrowserWindow {
  const mainWindow = new BrowserWindow({
    width: 1200,
    height: 800,
    webPreferences: {
      // Security essentials
      nodeIntegration: false,
      contextIsolation: true,
      sandbox: true,
      webSecurity: true,
      allowRunningInsecureContent: false,
      
      // Preload for safe IPC
      preload: path.join(__dirname, 'preload.js'),
    },
  });
  
  // Prevent navigation to external URLs
  mainWindow.webContents.on('will-navigate', (event, url) => {
    const allowed = ['http://localhost:', 'file://'];
    if (!allowed.some(prefix => url.startsWith(prefix))) {
      event.preventDefault();
      console.warn('Blocked navigation to:', url);
    }
  });
  
  // Prevent new windows
  mainWindow.webContents.setWindowOpenHandler(({ url }) => {
    shell.openExternal(url);  // Open in system browser
    return { action: 'deny' };
  });
  
  return mainWindow;
}