Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enable context isolation for better security in Electron #745

Closed
thamizh-qwerty opened this issue Feb 26, 2023 · 1 comment
Closed

Enable context isolation for better security in Electron #745

thamizh-qwerty opened this issue Feb 26, 2023 · 1 comment

Comments

@thamizh-qwerty
Copy link

Hello,

I noticed that the "angular-electron" project does not enable context isolation, which could potentially lead to security vulnerabilities. According to the Electron documentation, enabling context isolation provides an additional layer of security by preventing renderer processes from accessing the main process directly.

I would like to request that the "angular-electron" project enable context isolation in order to improve the security of the application. This can be done by setting the "contextIsolation" property to "true" in the Electron configuration.

Thank you for your attention to this matter.

@thamizh-qwerty thamizh-qwerty changed the title "Enable context isolation for better security in Electron" Enable context isolation for better security in Electron Feb 26, 2023
@maximegris
Copy link
Owner

maximegris commented Feb 26, 2023

Hi

I agree but in this scenario, it's obvious the developer needs to spend more effort on the electron side of the project because he/she needs to write there all the middle-layer logic to interact with node_modules libraries or Node APIs.
The purpose of this project is to stay as simple as possible and migrate to contextIsolation is not that hard if you follow the official documentation. That's why it's not enabled currently.

But I can change my mind and your PR is welcomed :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants