ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
A decision guide for Electron developers on implementing context isolation versus node integration to secure renderer processes and prevent RCE vulnerabilities.
Learn how Electron’s Context Isolation separates renderer and preload contexts, why enabling it improves security, and how to expose only the APIs you need via contextBridge.
Keep Electron's contextIsolation enabled and expose a minimal, typed API via contextBridge. This converts an implicit total-trust boundary into an explicit, auditable surface—preventing XSS from becoming full system compromise.
Learn how to expose only the needed IPC methods to your renderer using Electron's Context Isolation and ContextBridge, preventing accidental Node.js leakage.
Practical migration guide for moving legacy Electron apps to context isolation with secure IPC design, version-aware configuration, and incremental renderer refactoring.
Learn how Electron’s context isolation blocks XSS‑driven Node access and how to safely expose only the APIs you need via contextBridge.
Enabling nodeIntegration in NW.js gives renderers direct Node.js access, but it also removes the sandbox. Here's how to decide and how to replace it with a preload script.
Learn how Electron’s context isolation and contextBridge let you expose safe, limited APIs from the preload script to the renderer, keeping Node access locked down.
Learn how Electron’s context isolation feature prevents renderer code from accessing Node.js APIs directly and how to expose only the functions you need via contextBridge.
electron
nodewebkit