diego3g/electron-typescript-react

Is it possible to disable the node Integration option to use this boilerplate?

Closed this issue · 3 comments

gasscoelho commented

I was doing some research about security in Electron and found we should not enable nodeJs integration for Remote Content.

https://github.com/electron/electron/blob/master/docs/tutorial/security.md (second option)

So I tried to disable that option and got some issues -- I believe it was caused by some webpack configuration, not sure.

image

I'm not an expert in security but I like to follow as much as I can so I wonder if this should be a concern because basically we would be loading the Electron Renderer in localhost (dev environment) and in a static HTML page (prod environment), right?

What do you guys think?

wilgnne commented

When trying to replicate I got the same error, it really seems to be something in the react webpack, more specifically in the devServer, since in a build everything seems to happen well

wilgnne commented

I just found a solution to this problem, just change the webpack target of the react from electron-renderer to web, thus disabling all node integration.

webpack/react.webpack.js

module.exports = {
  ...
  target: 'web',
  ...
}
  • 👍1
gasscoelho commented

@wilgnne Thank you so much for your solution, I really appreciate it!!