How can Electron apps enforce least‑privilege authentication when using expired credentials in a persistent session?

Intercepting Expired Credentials in Electron

To enforce least-privilege authentication in a persistent Electron session without recreating the session, you must implement a request interception layer in the main process. Electron does not automatically filter out expired cookies or tokens based on their internal expiration dates before sending them; it follows standard HTTP cookie behavior, sending any validly stored cookie that matches the request domain.

Implementation via webRequest

The most effective way to suppress expired credentials or inject fresh ones is using the webRequest.onBeforeSendHeaders API. This allows you to inspect and modify headers before they leave the application.

1. Intercept Headers: Use session.webRequest.onBeforeSendHeaders to capture outgoing requests.
2. Validate State: Check your internal state (e.g., a timestamp stored in safeStorage or a local config) to determine if the current token is expired.
3. Modify or Block: If the credentials are stale, remove the Authorization header or the specific cookie from the request headers object to prevent leaking expired data to the server.

// Example: Suppressing an expired Authorization header
session.webRequest.onBeforeSendHeaders({ urls: ['https://api.example.com/*'] }, (details, callback) => {
  if (isTokenExpired()) {
    const filteredHeaders = details.requestHeaders.filter(
      header => header.name.toLowerCase() !== 'authorization'
    );
    callback({ requestHeaders: filteredHeaders });
  } else {
    callback({ cancel: false });
  }
});

Addressing Specific Constraints

• Automatic Filtering: Electron does not perform logic-based filtering of expired tokens; it relies on the cookie's Expires attribute. If the attribute has passed, the browser engine typically ignores the cookie, but custom Authorization headers are always sent unless intercepted.
• Stale Marking: There is no native API to "mark" a credential as stale within a session partition. You must maintain an external source of truth (like a secure store) to track token validity.
• Refresh Flow: The recommended pattern is to intercept a 401 Unauthorized response using webRequest.onCompleted or a network interceptor, trigger the refresh flow in the main process, and then retry the original request.

Assumptions and Verification

This approach assumes you are using contextIsolation: true and that the main process manages the authentication state. To verify this implementation, use the Chrome DevTools Network tab to ensure that requests sent after token expiration do not contain the Authorization header until the refresh flow completes.

Missing Diagnostic: Are you using standard HTTP cookies for session persistence, or a custom Authorization: Bearer header managed via localStorage/sessionStorage?