ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
Electron's contextIsolation feature separates Node.js and DOM contexts, preventing renderer code from accessing Node APIs directly and mitigating XSS and prototype pollution attacks.
A practical look at using contextIsolation, preload scripts, and contextBridge to keep Electron renderer processes from accessing Node.js directly.
Expose a limited API from Electron's preload script to the renderer with contextBridge, keeping Node integration disabled.
Renderer code calling window.myAPI gets undefined even though the preload script exposes it. This guide shows how to isolate the cause and fix it without weakening renderer security.
Enable Node integration in NW.js without exposing the full runtime to your renderer by combining context isolation with a preload-based API surface.
Prevent renderer code in Electron from accessing Node APIs by enabling contextIsolation, disabling nodeIntegration, and exposing a safe API via a preload script. This guide shows the minimal config, trust boundaries, checks, and failure modes.
Enable Electron’s context isolation to protect your app from injection attacks. Learn how to configure BrowserWindow, expose safe APIs via preload scripts, verify isolation, and handle trade‑offs with a practical example.
Enabling Node.js in Electron renderers the secure way, using contextIsolation, preload scripts, and contextBridge.
Electron's context isolation wall is deliberate — and contextBridge is the only door through it. A practical walkthrough of the preload/main/renderer pattern, Structured Clone pitfalls, and the escape hatches to avoid.
electron
nodewebkit