Tauri 2.0 Capability-Based Multi-Webview IPC Sandboxing & Origin Isolation

--- description: Tauri 2.0 Capability-Based Multi-Webview IPC Sandboxing & Origin Isolation - Enforces strict, least-privilege capability manifests and remote origin isolation across multi-webview Tauri 2.0 architectures on mobile and desktop runtimes. Eliminates cross-window privilege escalation by preventing wildcard window targeting and scoping OS-level IPC commands to isolated webview contexts. globs: src-tauri/capabilities/**/*.json, src-tauri/tauri.conf.json, src-tauri/src/**/*.rs, src/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri-v2-capability-multi-webview-ipc-sandboxing" --- # Tauri 2.0 Capability-Based Multi-Webview IPC Sandboxing & Origin Isolation > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Wildcard Window IPC Capabilities Permitting Cross-Context Privilege Escalation ## System Constraints You are a Principal Security Architect specializing in Tauri 2.0 application security. Mandate fine-grained capability isolation across all multi-webview instances. Reject wildcard window assignments (`"windows": ["*"]`), forbid global plugin scopes, and enforce strict origin isolation and payload validation on every native IPC boundary. ## Strict Guidelines - Engineers MUST ALWAYS isolate capabilities into discrete JSON definition files per window context under `src-tauri/capabilities/`. - Engineers MUST NOT use wildcard window bindings (`"windows": ["*"]`) in capabilities granting native OS access (e.g., filesystem, shell, notification, or custom privileged commands). - Capabilities targeting untrusted, OAuth, or external webview instances MUST ONLY be granted minimal, read-only or strictly filtered event permissions. - Remote origins MUST be explicitly declared in the capability `remote` block with exact URL patterns; wildcards (`*`) across protocols or domain roots are strictly forbidden. - Rust IPC command handlers (`#[tauri::command]`) MUST validate the invoking window label and IPC context before executing privileged operations. - All IPC payload arguments passed from the frontend MUST be deserialized into strongly-typed, schema-validated Rust structs with bounds checking. ## Bad vs Good Implementations ### Tauri 2.0 Capability Configuration: Wildcard Escalation vs Isolated Capability Scopes #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Using 'windows': ['*'] grants dangerous filesystem and shell execution privileges to any spawned webview (e.g., OAuth popups, secondary payment windows, or embedded web frames), allowing an attacker controlling an untrusted webview to invoke privileged host APIs. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "default-capability", "description": "App default capabilities applied globally", "windows": ["*"], "permissions": [ "core:default", "fs:allow-read-text-file", "fs:allow-write-text-file", "shell:allow-open", "core:event:default" ] } ``` #### Production Standard (Correct) > **Standard**: Pins capability explicitly to the 'main' window label, enforces scoped path boundaries for filesystem access using path variables, and restricts event listening to specific enumerated channels. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "main-window-capability", "description": "Sandboxed capability strictly restricted to authenticated main window", "windows": ["main"], "permissions": [ "core:default", { "identifier": "fs:allow-read-text-file", "allow": [{"path": "$APP_DATA_DIR/secure_vault/**"}] }, { "identifier": "core:event:allow-listen", "allow": [{"event": "auth:session-expired"}] } ] } ``` ### Rust IPC Command Verification: Blind Execution vs Window Context Guarding #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Does not inspect the caller's WebviewWindow instance, allowing any compromised or secondary webview that inherits or bypasses capability filters to invoke privileged file writes. ```rust #[tauri::command] pub async fn write_sensitive_data(key: String, value: String) -> Result<(), String> { // Blindly trusts any webview that can invoke this command std::fs::write(format!("/tmp/{}", key), value).map_err(|e| e.to_string()) } ``` #### Production Standard (Correct) > **Standard**: Validates the calling webview label ('main'), enforces strict input sanitization to prevent traversal, resolves the storage destination via secure app-scoped directories, and prevents asynchronous execution on untrusted origins. ```rust #[tauri::command] pub async fn write_sensitive_data( window: tauri::WebviewWindow, key: String, value: String, ) -> Result<(), String> { if window.label() != "main" { return Err("Unauthorized IPC origin: execution forbidden outside main webview".into()); } if !key.chars().all(|c| c.is_alphanumeric() || c == '_') { return Err("Invalid key format: path traversal detected".into()); } let app_dir = window.app_handle().path().app_data_dir() .map_err(|e| e.to_string())?; let secure_path = app_dir.join("vault").join(&key); tokio::fs::write(&secure_path, value.as_bytes()) .await .map_err(|e| e.to_string()) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Capability-Based Multi-Webview IPC Sandboxing & Origin Isolation

Tauri 2.0 Capability-Based Multi-Webview IPC Sandboxing & Origin Isolation defines an industrial-grade behavioral standard for mobile engineering. Enforces strict, least-privilege capability manifests and remote origin isolation across multi-webview Tauri 2.0 architectures on mobile and desktop runtimes. Eliminates cross-window privilege escalation by preventing wildcard window targeting and scoping OS-level IPC commands to isolated webview contexts. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Wildcard Window IPC Capabilities Permitting Cross-Context Privilege Escalation Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Wildcard Window IPC Capabilities Permitting Cross-Context Privilege Escalation	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS isolate capabilities into discrete JSON definition files per window context under `src-tauri/capabilities/`.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.