NW.js package.json nodejs integration and remote URL boundaries

Direct Answer

Restrict Node.js access for remote content by combining three mechanisms: set node-remote to a minimal allowlist (or [] to deny all) in package.json, load untrusted URLs in a <webview> with nodeintegration="false" and a dedicated partition, and enable Chromium Site Isolation via chromium-args. This preserves nodejs: true for your local entry point while isolating external origins.

Configuration Steps

1. Enable Node.js for the main window — keep "nodejs": true in package.json. This applies to the primary local entry point only.
2. Define the remote allowlist — add "node-remote": [] (empty array) to deny Node.js APIs to every remote origin, or list trusted domains: "node-remote": "https://api.trusted.example.com". Glob patterns are supported.
3. Isolate untrusted frames — embed remote URLs in a <webview src="https://untrusted.example.com" nodeintegration="false" partition="persist:untrusted"></webview>. The partition creates a separate storage/permission context.
4. Enable process-level isolation — add "chromium-args": "--site-per-process" to package.json so cross-origin iframes and webviews run in dedicated renderer processes.
5. Verify isolation — open DevTools for the webview (right-click → Inspect) and evaluate typeof require === 'function'; it should return false.

Assumptions and Version Notes

• NW.js 0.70+ is assumed for reliable contextIsolation and Site Isolation behavior; earlier versions (pre-0.68) have weaker guarantees.
• node-remote matches the final URL after redirects — a redirect to an unlisted origin drops Node.js access mid-navigation.
• <webview> partitions only achieve process isolation when --site-per-process is active; otherwise they share a renderer with same-origin frames.
• There is no per-window nodejs flag in nw.Window.open(); the package.json value governs the main window only.

Verification Checklist

# Check NW.js version
nw --version

# Minimal test: create package.json with nodejs:true, node-remote:[], chromium-args:"--site-per-process"
# Add index.html loading a webview to https://example.com
# Launch and inspect the webview DevTools console:
# typeof require === 'function'  // expect false

One Diagnostic Needed

What NW.js version are you targeting? Behavior around context isolation and Site Isolation improved significantly after 0.68, so the exact version changes whether contextIsolation via nw.Window.get().evalNWBin(null, { contextIsolation: true }) is available as an additional hardening layer.