NodeIntegration default false limits Node API usage in windows
0 reputation · 15 Aug 2020, 23:56 UTC
In NodeWebKit, the nodeIntegration flag is set to false by default for each window, preventing Node APIs from being accessed in the renderer process. This default behavior is intended to mitigate security risks, but it also imposes a limitation on developers who wish to use Node features without manually toggling the flag for every window.
The goal is to evaluate whether the default should remain false or shift to true to simplify development, while ensuring that any change can be safely rolled back if a schema alteration introduces unintended exposure of Node APIs.
Constraints include:
- Security of the user environment.
- Compatibility with existing applications that rely on
nodeIntegrationbeing disabled. - Ability to revert to a safe state after a schema change.
Unresolved questions:
- Is there a documented roadmap for changing the default
nodeIntegrationvalue in future releases? - What are the specific security risks if
nodeIntegrationis enabled globally? - How can a rollback mechanism be implemented to safely revert the schema if the new default leads to vulnerabilities?