AgentRules.org
RulesStacksClientsAuditorPrunerSelf-HealRFCsBenchmarkCLICI/CDAuthorsSubmit
This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →
mobilecritical PriorityID: tauri-v2-mobile-ipc-capability-scoping-guardrail

Tauri 2.0 Mobile IPC Capability Scoping & Webview Origin Isolation

Enforce zero-trust IPC isolation in Tauri 2.0 mobile applications by cryptographically constraining native plugin access to explicitly defined webview origins through capability manifests. Unrestricted wildcards in permissions, missing origin bindings, or global plugin invocations introduce arbitrary code execution vectors on iOS and Android targets.

Prohibited Anti-Pattern: Wildcard Capability Manifests Allowing Arbitrary Native OS Plugin Execution Across Untrusted Mobile Webview Origins

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: Tauri 2.0 Mobile IPC Capability Scoping & Webview Origin Isolation - Enforce zero-trust IPC isolation in Tauri 2.0 mobile applications by cryptographically constraining native plugin access to explicitly defined webview origins through capability manifests. Unrestricted wildcards in permissions, missing origin bindings, or global plugin invocations introduce arbitrary code execution vectors on iOS and Android targets.
globs: src-tauri/tauri.conf.json, src-tauri/capabilities/**/*.json, src-tauri/src/**/*.rs, src/**/*.{ts,tsx}
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/tauri-v2-mobile-ipc-capability-scoping-guardrail"
---

# Tauri 2.0 Mobile IPC Capability Scoping & Webview Origin Isolation

> **Severity**: CRITICAL | **Category**: mobile
> **Anti-Pattern Warning**: Wildcard Capability Manifests Allowing Arbitrary Native OS Plugin Execution Across Untrusted Mobile Webview Origins

## System Constraints
You are a Principal Security Architect enforcing Tauri 2.0 IPC capability scoping and strict webview origin isolation on mobile platforms (iOS and Android). You must prevent wildcard capability definitions, prohibit exposing dangerous OS plugins to arbitrary mobile webview windows, mandate cryptographic validation for remote origins, and guarantee that native plugins (Biometric, FileSystem, DeepLink, Notifications) are constrained to isolated, least-privilege capability manifests.

## Strict Guidelines
- Engineers MUST ALWAYS isolate distinct mobile webview windows into dedicated capability manifests under 'src-tauri/capabilities/*.json' instead of granting global access in 'tauri.conf.json'.
- Engineers MUST NEVER use wildcard permissions (e.g., 'fs:default', 'shell:all', 'core:default') in capability manifests for mobile production builds.
- Engineers MUST explicitly bind capabilities to precise webview identifiers and cryptographically verified domain origins using the 'remote' property or isolated internal local schemes.
- Code SHOULD validate the calling origin in custom Rust commands using the 'tauri::ipc::Request' origin context prior to executing any sensitive OS-level mobile logic.
- Services MUST enforce granular permission sets (e.g., specifying exact read/write paths for filesystem access rather than global scope) to maintain zero-trust boundaries on Android and iOS.
- Components NEVER invoke Tauri core IPC directly via raw window.__TAURI_INTERNALS__ without using typed, capability-bound invoke wrappers that guard against cross-origin spoofing.

## Bad vs Good Implementations
### Overly Permissive Capabilities vs Granular Origin-Isolated Capability Manifest

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Using '*' for windows and assigning global default permission sets (e.g., 'fs:default', 'shell:default') gives any webview context complete access to sensitive OS plugins without origin validation, enabling remote code execution via WebView redirection or XSS.
```json
{
  "$schema": "../gen/schemas/desktop-schema.json",
  "identifier": "mobile-capability-all",
  "description": "Anti-pattern: Wildcard capabilities granting untrusted origins global native access",
  "windows": ["*"],
  "permissions": [
    "core:default",
    "fs:default",
    "shell:default",
    "biometric:default"
  ]
}
```

#### Production Standard (Correct)
> **Standard**: Restricts OS capability access to the explicitly named 'main' mobile webview window and its verified origin. Replaces coarse defaults with explicit actions ('biometric:allow-authenticate') and scoped filesystem paths ($APPDATA/secure_tokens/*).
```json
{
  "$schema": "../gen/schemas/desktop-schema.json",
  "identifier": "mobile-auth-isolated-capability",
  "description": "Constrained native capabilities bound strictly to the authenticated mobile main window",
  "windows": ["main"],
  "remote": {
    "urls": ["https://app.production.internal"]
  },
  "permissions": [
    "core:event:allow-listen",
    "biometric:allow-authenticate",
    {
      "identifier": "fs:allow-read-text-file",
      "allow": [
        { "path": "$APPDATA/secure_tokens/*" }
      ]
    }
  ]
}
```

### Unvalidated Custom Rust IPC Command vs Origin-Verified Command Handler

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Fails to inspect the IPC request origin or verify the caller context. Any injected script or third-party webview frame can invoke this native command without restriction.
```rust
// Anti-pattern: Missing origin validation in custom native mobile command
#[tauri::command]
pub fn execute_native_wipe(webview: tauri::Webview) -> Result<(), String> {
    // Executes severe native OS operation without verifying webview origin
    native_storage::purge_keystore();
    Ok(())
}
```

#### Production Standard (Correct)
> **Standard**: Explicitly extracts and asserts the caller origin from the IPC request headers before executing the privileged native operation, ensuring origin isolation even if the webview navigates.
```rust
// Production standard: Rust IPC command enforcing explicit origin isolation
#[tauri::command]
pub fn execute_native_wipe(
    request: tauri::ipc::Request<'_>,
    app_handle: tauri::AppHandle,
) -> Result<(), String> {
    let origin = request.headers().get("Origin")
        .and_then(|v| v.to_str().ok())
        .ok_or_else(|| "Missing IPC origin header".to_string())?;

    if origin != "tauri://localhost" && origin != "https://app.production.internal" {
        return Err("Unauthorized webview origin for OS native execution".to_string());
    }

    native_storage::purge_keystore();
    Ok(())
}
```
Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

Tauri CLI Inspector MCP
MCP endpoint for running validation sweeps and auditing Tauri capability schemas against active mobile profiles.
Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

Cargo Audit and Tauri Capability Validator
Validates Tauri 2.0 configuration manifests, checking for unsafe capabilities and out-of-date mobile plugin crates.
Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Mobile IPC Capability Scoping & Webview Origin Isolation

Tauri 2.0 Mobile IPC Capability Scoping & Webview Origin Isolation defines an industrial-grade behavioral standard for mobile engineering. Enforce zero-trust IPC isolation in Tauri 2.0 mobile applications by cryptographically constraining native plugin access to explicitly defined webview origins through capability manifests. Unrestricted wildcards in permissions, missing origin bindings, or global plugin invocations introduce arbitrary code execution vectors on iOS and Android targets. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Wildcard Capability Manifests Allowing Arbitrary Native OS Plugin Execution Across Untrusted Mobile Webview Origins Without an explicit system instruction file, developers spend hours debugging silent failures.
Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure ModeAI Symptom (The Anti-Pattern)SeverityProduction Impact & Remedy
AI Hallucination & Deprecation DriftWildcard Capability Manifests Allowing Arbitrary Native OS Plugin Execution Across Untrusted Mobile Webview OriginsCritical
Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production.
Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture InconsistencyAI assistants produce mixed paradigms across files, creating fragmented codebase conventions.Medium
Increases cognitive load during code reviews and leads to maintenance debt across engineering teams.
Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.
Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Engineers MUST ALWAYS isolate distinct mobile webview windows into dedicated capability manifests under 'src-tauri/capabilities/*.json' instead of granting global access in 'tauri.conf.json'.

Engineers MUST ALWAYS isolate distinct mobile webview windows into dedicated capability manifests under 'src-tauri/capabilities/*.json' instead of granting global access in 'tauri.conf.json'.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
2

Engineers MUST NEVER use wildcard permissions (e.g., 'fs

Engineers MUST NEVER use wildcard permissions (e.g., 'fs:default', 'shell:all', 'core:default') in capability manifests for mobile production builds.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
3

Engineers MUST explicitly bind capabilities to precise webview identifiers and cryptographically verified domain origins using the 'remote' property or isolated internal local schemes.

Engineers MUST explicitly bind capabilities to precise webview identifiers and cryptographically verified domain origins using the 'remote' property or isolated internal local schemes.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
4

Code SHOULD validate the calling origin in custom Rust commands using the 'tauri

Code SHOULD validate the calling origin in custom Rust commands using the 'tauri::ipc::Request' origin context prior to executing any sensitive OS-level mobile logic.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
5

Services MUST enforce granular permission sets (e.g., specifying exact read/write paths for filesystem access rather than global scope) to maintain zero-trust boundaries on Android and iOS.

Services MUST enforce granular permission sets (e.g., specifying exact read/write paths for filesystem access rather than global scope) to maintain zero-trust boundaries on Android and iOS.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
6

Components NEVER invoke Tauri core IPC directly via raw window.__TAURI_INTERNALS__ without using typed, capability-bound invoke wrappers that guard against cross-origin spoofing.

Components NEVER invoke Tauri core IPC directly via raw window.__TAURI_INTERNALS__ without using typed, capability-bound invoke wrappers that guard against cross-origin spoofing.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is Tauri 2.0 Mobile IPC Capability Scoping & Webview Origin Isolation critical for AI coding assistants?

Enforce zero-trust IPC isolation in Tauri 2.0 mobile applications by cryptographically constraining native plugin access to explicitly defined webview origins through capability manifests. Unrestricted wildcards in permissions, missing origin bindings, or global plugin invocations introduce arbitrary code execution vectors on iOS and Android targets. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Wildcard Capability Manifests Allowing Arbitrary Native OS Plugin Execution Across Untrusted Mobile Webview Origins) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related MOBILE Rules

View all rules →
mobile
106

Tauri 2.0 Mobile IPC & Capabilities Permissions Matrix Standard

Tauri v2 introduces a capability-driven permissions system replacing legacy v1 allowlists across iOS and Android runtimes. Failure to constrain IPC command handlers with typed schemas and explicit mobile capability definitions exposes native mobile OS surfaces to arbitrary code execution, permission leakage, and silent serialization failures. Production mobile deployments require strictly typed IPC boundary validation, granular capability scopes, and graceful permission degradation.

mobile
70

Capacitor 7 Native Bridge, Biometric Auth & Android 15 Lifecycle Production Standard

Capacitor 7 enforces strict bridge lifecycle contracts, asynchronous native plugin interop, and mandatory Android 15 edge-to-edge window inset handling. Storing sensitive authentication tokens in unencrypted web storage or failing to bind biometric authentication directly to hardware-backed Keystore or Secure Enclave mechanisms compromises app integrity and causes fatal crash or viewport occlusion issues on modern mobile operating systems.

mobile
58

Tauri 2.0 Mobile IPC Isolation and Capabilities Permission Scoping

Enforces strict capability permission boundaries, payload validation, and secure IPC invoke scoping for Tauri v2 Android and iOS environments. Prevents arbitrary IPC command execution, excessive native privilege granting, and deserialization vulnerabilities across the mobile webview-native boundary.

1 Rule in Stack

Tauri