Tauri 2.0 Hardened IPC Protocol and Strict Schema Enforcement | AgentRules.org

Rules Stacks Clients Auditor Pruner Self-Heal RFCs Benchmark CLI CI/CD Authors Submit

This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →

mobilecritical PriorityID: tauri-2-hardened-ipc-protocol-guardrails

Tauri 2.0 Hardened IPC Protocol and Strict Schema Enforcement

Enforces a zero-trust boundary between mobile WebViews and the native Rust core in Tauri 2.0 applications. Mandates compile-time generated type contracts and strict Serde deserialization to eliminate Remote Code Execution (RCE), command injection, and arbitrary memory mutation vectors. Requires complete prohibition of unconstrained payload passing and untyped invoke channels.

Prohibited Anti-Pattern: Unvalidated Raw String and Untyped Object Passing Over WebView-to-Rust IPC Channels

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: Tauri 2.0 Hardened IPC Protocol and Strict Schema Enforcement - Enforces a zero-trust boundary between mobile WebViews and the native Rust core in Tauri 2.0 applications. Mandates compile-time generated type contracts and strict Serde deserialization to eliminate Remote Code Execution (RCE), command injection, and arbitrary memory mutation vectors. Requires complete prohibition of unconstrained payload passing and untyped invoke channels.
globs: src-tauri/src/**/*.rs, src/**/*.{ts,tsx}
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/tauri-2-hardened-ipc-protocol-guardrails"
---

# Tauri 2.0 Hardened IPC Protocol and Strict Schema Enforcement

> **Severity**: CRITICAL | **Category**: mobile
> **Anti-Pattern Warning**: Unvalidated Raw String and Untyped Object Passing Over WebView-to-Rust IPC Channels

## System Constraints
You are a Principal Security Architect and Systems Engineer specializing in Tauri 2.0 mobile security. Your role is to mandate hardened IPC boundaries between the mobile WebView and the Rust host runtime. Enforce compile-time schema validation (via tauri-specta or strict Serde contracts with deny_unknown_fields), forbid generic invoke calls, isolate mobile native capabilities via Tauri 2.0 capability permissions, and prevent command injection through strict domain-specific Rust types.

## Strict Guidelines
- Engineers MUST ALWAYS enforce bidirectional compile-time type contracts between TypeScript and Rust using tooling like tauri-specta or strictly validated JSON-RPC schemas.
- Engineers MUST NOT invoke Tauri commands using raw strings or unconstrained generic types (e.g., `invoke<any>('cmd', { payload })`); all IPC calls MUST route through statically generated, strongly-typed wrappers.
- Rust IPC command structs MUST ALWAYS derive `serde::Deserialize` and `serde::Serialize` with `#[serde(deny_unknown_fields)]` to prevent prototype pollution and unexpected payload smuggling.
- Rust command handlers MUST NEVER accept raw shell strings, raw file paths, or arbitrary URLs from the WebView without explicit domain-validated newtypes.
- Mobile capability permissions defined in Tauri 2.0 (`src-tauri/capabilities/`) MUST follow the principle of least privilege, explicitly restricting command access per WebView context.

## Bad vs Good Implementations
### Unsafe Dynamic IPC Invoke vs Type-Contracted Specta IPC Pattern

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Bypasses compile-time type safety by using generic string invokes and raw untyped payloads. The Rust backend is vulnerable to path traversal, parameter injection, and unexpected payload smuggling if Serde allows unknown fields.
```typescript
import { invoke } from '@tauri-apps/api/core';

// VULNERABLE: Untyped invoke with dynamic arguments opens injection surface
export async function executeUserFileAction(rawPath: string, actionType: string) {
  return await invoke<any>('process_user_file', {
    path: rawPath,
    action: actionType,
    metadata: JSON.stringify({ timestamp: Date.now() })
  });
}
```

#### Production Standard (Correct)
> **Standard**: Enforces compile-time schema contracts generated by tauri-specta. On the Rust backend, commands map to strictly validated enums decorated with #[serde(deny_unknown_fields)], eliminating unconstrained dynamic dispatch and input tampering.
```typescript
import { commands } from '../bindings/generated'; // Generated via tauri-specta

// HARDENED: Statically guaranteed type contracts backed by strict Rust enum types
export async function executeUserFileAction(fileId: string, action: 'Read' | 'Validate') {
  const result = await commands.processUserFile({
    fileId,
    action
  });
  
  if (result.status === 'error') {
    throw new Error(result.error);
  }
  return result.data;
}
```

Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

Rust Analyzer MCP

Validates Rust Serde attributes, types, and Tauri command signature contracts during editing.

Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

Audits mobile permissions, runs capability validations, and generates IPC contract types.

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Hardened IPC Protocol and Strict Schema Enforcement

Tauri 2.0 Hardened IPC Protocol and Strict Schema Enforcement defines an industrial-grade behavioral standard for mobile engineering. Enforces a zero-trust boundary between mobile WebViews and the native Rust core in Tauri 2.0 applications. Mandates compile-time generated type contracts and strict Serde deserialization to eliminate Remote Code Execution (RCE), command injection, and arbitrary memory mutation vectors. Requires complete prohibition of unconstrained payload passing and untyped invoke channels. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Unvalidated Raw String and Untyped Object Passing Over WebView-to-Rust IPC Channels Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Unvalidated Raw String and Untyped Object Passing Over WebView-to-Rust IPC Channels	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Engineers MUST ALWAYS enforce bidirectional compile-time type contracts between TypeScript and Rust using tooling like tauri-specta or strictly validated JSON-RPC schemas.

Engineers MUST ALWAYS enforce bidirectional compile-time type contracts between TypeScript and Rust using tooling like tauri-specta or strictly validated JSON-RPC schemas.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.

Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.

2

Engineers MUST NOT invoke Tauri commands using raw strings or unconstrained generic types (e.g., `invoke<any>('cmd', { payload })`)

Engineers MUST NOT invoke Tauri commands using raw strings or unconstrained generic types (e.g., `invoke<any>('cmd', { payload })`); all IPC calls MUST route through statically generated, strongly-typed wrappers.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.

Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.

3

Rust IPC command structs MUST ALWAYS derive `serde

Rust IPC command structs MUST ALWAYS derive `serde::Deserialize` and `serde::Serialize` with `#[serde(deny_unknown_fields)]` to prevent prototype pollution and unexpected payload smuggling.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.

Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.

4

Rust command handlers MUST NEVER accept raw shell strings, raw file paths, or arbitrary URLs from the WebView without explicit domain-validated newtypes.

Rust command handlers MUST NEVER accept raw shell strings, raw file paths, or arbitrary URLs from the WebView without explicit domain-validated newtypes.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.

Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.

5

Mobile capability permissions defined in Tauri 2.0 (`src-tauri/capabilities/`) MUST follow the principle of least privilege, explicitly restricting command access per WebView context.

Mobile capability permissions defined in Tauri 2.0 (`src-tauri/capabilities/`) MUST follow the principle of least privilege, explicitly restricting command access per WebView context.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.

Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.

Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is Tauri 2.0 Hardened IPC Protocol and Strict Schema Enforcement critical for AI coding assistants?

Enforces a zero-trust boundary between mobile WebViews and the native Rust core in Tauri 2.0 applications. Mandates compile-time generated type contracts and strict Serde deserialization to eliminate Remote Code Execution (RCE), command injection, and arbitrary memory mutation vectors. Requires complete prohibition of unconstrained payload passing and untyped invoke channels. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Unvalidated Raw String and Untyped Object Passing Over WebView-to-Rust IPC Channels) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related MOBILE Rules

View all rules →

Tauri 2.0 Mobile IPC & Capabilities Permissions Matrix Standard

Tauri v2 introduces a capability-driven permissions system replacing legacy v1 allowlists across iOS and Android runtimes. Failure to constrain IPC command handlers with typed schemas and explicit mobile capability definitions exposes native mobile OS surfaces to arbitrary code execution, permission leakage, and silent serialization failures. Production mobile deployments require strictly typed IPC boundary validation, granular capability scopes, and graceful permission degradation.

Capacitor 7 Native Bridge, Biometric Auth & Android 15 Lifecycle Production Standard

Capacitor 7 enforces strict bridge lifecycle contracts, asynchronous native plugin interop, and mandatory Android 15 edge-to-edge window inset handling. Storing sensitive authentication tokens in unencrypted web storage or failing to bind biometric authentication directly to hardware-backed Keystore or Secure Enclave mechanisms compromises app integrity and causes fatal crash or viewport occlusion issues on modern mobile operating systems.

Tauri 2.0 Mobile IPC Isolation and Capabilities Permission Scoping

Enforces strict capability permission boundaries, payload validation, and secure IPC invoke scoping for Tauri v2 Android and iOS environments. Prevents arbitrary IPC command execution, excessive native privilege granting, and deserialization vulnerabilities across the mobile webview-native boundary.

1 Rule in Stack

Tauri