Electron contextBridge: limiting ipcRenderer.invoke to specific IPC channels

Answer

For untrusted or remote renderer windows, expose only the IPC channels you intend to allow, using one named function per channel in the preload script.

Why this is recommended

• With contextIsolation enabled (default since Electron 12) and nodeIntegration disabled, the renderer cannot reach ipcRenderer directly; it can only call what the preload exposes via contextBridge.exposeInMainWorld.
• A generic invoke(channel, …args) wrapper effectively trusts every channel handled in the main process. If the whitelist check fails, the renderer can still reach any other exposed channel.
• Exposing a dedicated function per channel (e.g. window.electron.getUser = () => ipcRenderer.invoke('get-user')) makes the attack surface explicit and eliminates the need for a runtime whitelist.

When a generic wrapper is acceptable

1. Define an allow‑list of channel names in the preload (e.g. const ALLOWED = ['get-user', 'save-settings'];).
2. Create a wrapper that checks the channel against the list and throws for anything else:

const safeInvoke = (channel, ...args) => {
  if (!ALLOWED.includes(channel)) throw new Error(`Channel ${channel} not allowed`);
  return ipcRenderer.invoke(channel, ...args);
};
contextBridge.exposeInMainWorld('electron', { invoke: safeInvoke });

3. Even with this wrapper, every ipcMain.handle must still validate arguments, authorization, and the target window, because the preload cannot guarantee safe arguments.

Where to place validation

• Preload: keep the channel allow‑list here to define the renderer’s attack surface.
• Main process: validate each ipcMain.handle listener for arguments, permissions, and window‑specific policy. This is the trust boundary.

Effect of sandbox: true

Enabling sandbox adds renderer‑level restrictions (no Node APIs, limited DOM access) but does not remove the need to limit IPC channels. The same options apply: per‑channel exposure or a strictly checked preload whitelist plus main‑side validation.