Enable nodeIntegration or Use Preload Scripts: Which Safeguards the Renderer Process in NW.js?

Answer

For the safest renderer environment, disable nodeIntegration and use a preload script that exposes only the APIs the renderer needs. Enabling nodeIntegration is convenient but gives the renderer full Node.js access, which is a security risk if the page is not fully trusted.

How NW.js Handles Context Isolation

NW.js 0.54 and newer turn nodeIntegration off by default. When it is off, the global Node objects (require, process, __dirname, etc.) are undefined in the renderer. However, NW.js does not automatically enable a separate “context” sandbox; the renderer still runs in the same process and can access native modules only through the preload script. If a build or launch script supplies legacy flags such as --nodejs or --allow-natives-syntax, Node globals can leak back into the renderer, even when nodeIntegration is set to false. Therefore the only guaranteed way to enforce isolation is to set nodeIntegration:false and to avoid legacy flags that re‑enable Node.

Isolating the Renderer with a Preload Script

A preload script runs before any page script and has full Node access. By exposing a tiny, vetted API surface on window, you keep the renderer sandboxed while still allowing native module usage. Example:

/* preload.js */
const fs = require('fs');
const path = require('path');

// Expose only the helpers the renderer needs
window.myAPI = {
  readFile: (filePath) => fs.readFileSync(path.resolve(filePath), 'utf8'),
  // add more functions as required
};

In your window options (in package.json or when creating a window programmatically) set:

{
  "nodeIntegration": false,
  "preload": "preload.js"
}

With nodeIntegration disabled, require and other Node globals are not available in the renderer. The only way to reach Node functionality is through window.myAPI (or whatever name you choose).

Migration Steps for Projects Relying on Global Node APIs

1. Audit for Node globals
   • Search renderer files for require, process, __dirname, global, or any direct Node module imports.
2. Create the preload API
   • List the Node functions your renderer really needs (e.g., fs.readFileSync, path.join).
   • Expose them on window as shown above.
3. Update window options
   • Set nodeIntegration:false and point preload to your script.
4. Replace direct Node calls
   • Change code such as const data = require('fs').readFileSync('config.json'); to const data = window.myAPI.readFile('config.json');.
5. Verify isolation
   • Open the renderer console and type require or process. A ReferenceError indicates isolation is active.
   • Call an exposed function (e.g., window.myAPI.readFile('config.json')) to confirm it works.

Diagnostic Question

To be certain that legacy flags are not re‑enabling Node in your build, check whether your packaging or launch command includes any of the following options: --nodejs, --allow-natives-syntax, or a custom nodeIntegration flag set to true.

Uncertainty

NW.js does not provide a built‑in contextBridge like Electron. Isolation relies solely on disabling nodeIntegration and carefully controlling what the preload script exposes. If your project uses older NW.js releases or custom build flags, the behavior may differ; manual verification is recommended.