Tauri 2.0 IPC SharedArrayBuffer Zero-Copy Isolation Standard

--- description: Tauri 2.0 IPC SharedArrayBuffer Zero-Copy Isolation Standard - Enforces strict Cross-Origin Isolation (COOP/COEP) and window-bound origin gating when executing high-throughput binary IPC between Tauri 2.0 native core and webview contexts. Prevents microarchitectural Spectre timing side-channel attacks and cross-origin memory leakage when exposing zero-copy binary streams or SharedArrayBuffer instances to renderers. globs: src-tauri/tauri.conf.json, src-tauri/src/**/*.rs, src/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri-v2-ipc-sharedarraybuffer-zero-copy-isolation" --- # Tauri 2.0 IPC SharedArrayBuffer Zero-Copy Isolation Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Exposing Raw Shared Buffers or High-Resolution IPC Streaming Without Enforcing Cross-Origin Isolation Contexts ## System Constraints You are a Principal Security Architect enforcing the Tauri 2.0 IPC SharedArrayBuffer Zero-Copy Isolation Standard. Spectre variants exploit high-resolution timers and SharedArrayBuffer shared memory concurrency to infer memory contents across execution boundaries. You must strictly mandate Cross-Origin-Opener-Policy (COOP) and Cross-Origin-Embedder-Policy (COEP) headers, verify window.crossOriginIsolated, and prohibit un-fenced raw memory transfer across untrusted webview windows or iframes. ## Strict Guidelines - Engineers MUST ALWAYS verify window.crossOriginIsolated is true before allocating or accepting SharedArrayBuffer references or high-resolution binary channels in webview renderers. - Engineers MUST NOT stream zero-copy native memory pointers or raw SharedArrayBuffer handles to untrusted, unpartitioned, or remote webview contexts. - Code MUST configure Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Embedder-Policy: require-corp (or credentialless) on custom protocols and webview responses in tauri.conf.json. - Services MUST enforce cryptographic webview window label verification and IPC origin token validation in Rust command handlers before granting access to high-throughput binary channels. - Components NEVER execute raw binary IPC streaming across multi-tenant or third-party iframe boundaries without explicit IPC capability fencing in Tauri 2.0 ACL manifests. ## Bad vs Good Implementations ### Enforcing Cross-Origin Isolation and Safe Binary IPC Buffer Ingestion #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Allocates a SharedArrayBuffer without verifying window.crossOriginIsolated or checking execution context constraints. If malicious cross-origin resources or unsecured iframes run inside the webview window, Spectre cache timing attacks can infer memory across execution boundaries. ```typescript import { invoke } from '@tauri-apps/api/core'; // VULNERABLE: Direct SharedArrayBuffer allocation without cross-origin isolation verification // Exposes process memory to Spectre timing attacks if iframes or non-isolated contexts coexist export async function initializeBinaryStream(streamId: string): Promise<SharedArrayBuffer> { const bufferSize = 1024 * 1024 * 16; // 16MB stream const sharedBuffer = new SharedArrayBuffer(bufferSize); // Transmitting shared buffer handle directly to core without origin confirmation await invoke('register_shared_memory_channel', { streamId, buffer: sharedBuffer }); return sharedBuffer; } ``` #### Production Standard (Correct) > **Standard**: Validates that the execution environment satisfies window.crossOriginIsolated (ensuring COOP and COEP are strictly configured), checks that the execution context is top-level to prevent embedded frame side-channels, and uses scoped ArrayBuffer response transfers instead of un-fenced SharedArrayBuffers. ```typescript import { invoke } from '@tauri-apps/api/core'; export class SecurityContextError extends Error { constructor(message: string) { super(message); this.name = 'SecurityContextError'; } } // HARDENED: Validates strict cross-origin isolation and falls back safely export async function initializeBinaryStream(streamId: string): Promise<Uint8Array> { // Mandate active COOP/COEP isolation context to defend against Spectre if (typeof window === 'undefined' || !window.crossOriginIsolated) { throw new SecurityContextError( 'IPC Isolation Invariant Violated: Shared memory requires crossOriginIsolated (COOP/COEP) context.' ); } // Prevent invocation from untrusted embedded frame contexts if (window.self !== window.top) { throw new SecurityContextError( 'Unauthorized IPC Frame Context: High-throughput binary streaming forbidden inside embedded frames.' ); } // Request native binary transfer using Tauri 2.0 fenced response channel with isolated typed array const rawData = await invoke<ArrayBuffer>('stream_binary_payload', { streamId, originToken: crypto.randomUUID() }); return new Uint8Array(rawData); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 IPC SharedArrayBuffer Zero-Copy Isolation Standard

Tauri 2.0 IPC SharedArrayBuffer Zero-Copy Isolation Standard defines an industrial-grade behavioral standard for security engineering. Enforces strict Cross-Origin Isolation (COOP/COEP) and window-bound origin gating when executing high-throughput binary IPC between Tauri 2.0 native core and webview contexts. Prevents microarchitectural Spectre timing side-channel attacks and cross-origin memory leakage when exposing zero-copy binary streams or SharedArrayBuffer instances to renderers. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Exposing Raw Shared Buffers or High-Resolution IPC Streaming Without Enforcing Cross-Origin Isolation Contexts Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Exposing Raw Shared Buffers or High-Resolution IPC Streaming Without Enforcing Cross-Origin Isolation Contexts	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS verify window.crossOriginIsolated is true before allocating or accepting SharedArrayBuffer references or high-resolution binary channels in webview renderers.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.