0

I made an app that reads files and displays them.

I read the docs that I should disable node integration and enable context isolation for better security and also i get a warning that electron will disable node integration by default and enable context isolation in 5.0.0.

EDIT: When node is disabled I get an error : require is not defined. My files are all required in html inside a <script>.

I also mention that I'm new to electron.

How can I use my files with node integration disabled?

Rozwan
  • 7
  • 6
  • This only applies to the render thread. You can still do whatever you want in the main thread and communicate with it through IPC. – tkausl Jan 31 '19 at 21:32

1 Answers1

0

How can I use my files with node integration disabled?

If your files require Node, then you can't. Turn node integration on.

You should disable node integration only if you don't need Node since disabling it will reduce the attack surface. Also Principle of least privilege.

If you need to use require in your script, then don't disable Node integration.

That being said, you can disable node integration and supply a preload script to your webview tag, which will let you expose specific Node APIs to that script only. (If you need to require modules in your file though, it sounds like you'd need to keep Node enabled).

Electron's Security page says the following (emphasis added):

Under no circumstances should you load and execute remote code with Node.js integration enabled. Instead, use only local files (packaged together with your application) to execute Node.js code. To display remote content, use the <webview> tag and make sure to disable the nodeIntegration.

Note: you should disable Node for remote content. If you're loading your own page, then it's fine to keep Node integration on.

pushkin
  • 9,575
  • 15
  • 51
  • 95
  • I'm making a file browser, so I don't use any other websites nor internet connection, then everything is ok right? – Rozwan Feb 01 '19 at 09:02
  • Yeah if you're not hosting any remote content, and it's all contained within your app, you should be good – pushkin Feb 01 '19 at 15:20
  • I provide a little more info about using contextIsolation etc here: https://stackoverflow.com/a/57656281/289203 – Luke H Nov 15 '19 at 00:02