ContextIsolation: Limits on Legacy Node Integration in Electron v15+

Answer

1. To detect Node‑API dependence, wrap accesses to known Node globals (e.g., require, process, Buffer) in a try/catch inside the renderer; if a ReferenceError is thrown or the value is undefined, the script relies on blocked APIs and must be refactored or exposed via a preload script.
2. Expose only the needed functionality through a preload script that uses contextBridge.exposeInMainWorld. For example, expose a promisified fs.readFile or a small os helper, and remove all direct require calls from the renderer. Use ipcRenderer.invoke for operations that should stay in the main process.
3. Yes. Set webPreferences.contextIsolation per BrowserWindow. Create legacy windows with { contextIsolation: false, nodeIntegration: true } and new windows with { contextIsolation: true }. Remember that disabling isolation reduces security and should be temporary.

Confirmed Facts

• Electron v15+ defaults contextIsolation to true.
• When isolation is enabled, any direct access to Node globals (require, process, Buffer, etc.) throws a ReferenceError unless exposed via contextBridge.
• contextIsolation can be set individually in each BrowserWindow’s webPreferences.

Likely Explanation / Recommendations

Detection by trying to read Node globals is reliable for spotting missing exposure, but it cannot tell whether a script uses a Node API indirectly (e.g., via a bundled library). For full confidence, audit dependencies or run the script with isolation enabled and observe any errors.