ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
NW.js lets DOM JavaScript call Node directly — but whether those worlds share one context is the decision that determines your app's security posture. Here's how to structure around it.
Goal: Configure the NW.js DevTools remote debugging interface so that it listens only on the localhost loopback address (127.0.0.1) to prevent unintended network exposure. Constraint: By default, when DevTools are enabled the builder binds the debugging listener to all interfaces (0.0.0.0) and the NW.js manifest or command‑line interface does not expose a bu
Node-Remote Whitelist Behavior in Production Builds When an NW.js app is run in development mode, any loaded page—including those from remote URLs—has automatic access to Node.js APIs. However, after packaging the application, the default sandbox prevents Node.js integration for remote content unless the page’s origin is explicitly listed in the node-remote
Context Since NW.js 0.46.0, the Notification API respects the OS focus-assist / do-not-disturb settings, and the {silent: true} option suppresses the sound and banner while still delivering the message to the Windows Action Center or macOS Notification Center. I am migrating an app from a pre-0.46 release, where the silent flag appears to have been ignored o
Goal When opening a window with nw.Window.open(url, {show:false}, callback) the application wants to guarantee that the window is destroyed if the page does not finish loading within a configurable time interval, preventing hidden windows from staying alive and keeping associated Node.js timers, streams or child processes running. Constraints and uncertainty
When upgrading an NW.js application from the 0.57.x series to 0.58.0, the bundled Node.js version changes from 14.x to 18.x, which updates the V8 engine and the Node‑API (N‑API) version. This change breaks binary compatibility for any native addon compiled against the older ABI, so the addons must be rebuilt or replaced to work with the new runtime. The deve
I am building a desktop app on NW.js (assume a recent 0.8x release; I will confirm the bundled Chromium version via nw.process.versions ) that surfaces background events from the Node context — file watcher hits and scheduled sync results — as desktop notifications using the standard HTML5 Notification constructor in the window context. The design concern is
Goal: Select a method for exposing necessary Node.js functionality to the renderer process in an NW.js application that remains secure when the app loads remote content in production. Constraints: The chosen approach must prevent code‑injection attacks, require an explicit whitelist of modules, and ensure that any preload script used to bridge Node APIs reso
Production Path Discrepancies During local development, the NW.js nw command resolves resource paths relative to the current working directory. However, in a packaged application, the working directory shifts to the application root. This change often causes relative paths that function correctly in development to fail in production unless they are explicitl
nodewebkit
nodejs