Tauri 2.0 Multi-WebView IPC Isolation & Capability Scoping

--- description: Tauri 2.0 Multi-WebView IPC Isolation & Capability Scoping - Enforces strict window-scoped capability segregation and IPC context isolation across multi-webview Tauri 2.0 mobile architectures. Mandates explicit webview label binding in capability configurations and cryptographic caller validation within Rust command handlers to prevent secondary webviews from invoking privileged native operations. globs: src-tauri/capabilities/**/*.json, src-tauri/src/**/*.rs, src/**/*.ts, src/**/*.tsx alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri-v2-multi-webview-ipc-isolation-fence" --- # Tauri 2.0 Multi-WebView IPC Isolation & Capability Scoping > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Ambient Native Exposure via Wildcard IPC Capability Allocation Across WebViews ## System Constraints You are a Principal Security Architect enforcing Tauri 2.0 Multi-WebView IPC Isolation. In multi-webview Tauri mobile deployments, native platform capabilities (biometrics, secure keystore, camera, file system) must be strictly partitioned. You must mandate zero-trust window capability mapping, enforce per-webview capability JSON configurations, verify caller webview labels directly in Rust IPC handler signatures, and forbid ambient execution or wildcard permissions. ## Strict Guidelines - Engineers MUST ALWAYS isolate capabilities per window label inside `src-tauri/capabilities/*.json` using explicit `windows` arrays instead of default wildcard inheritance. - Engineers MUST extract and validate the caller `tauri::Webview` or `tauri::WebviewWindow` instance within every privileged Rust command handler to verify the executing window context. - Engineers MUST NOT grant high-privilege native capabilities (e.g., biometrics, secure storage, deep links) to secondary, ephemeral, or external-facing webviews. - Code SHOULD implement Tauri 2.0's Isolation Pattern with a cryptographic runtime challenge when untrusted or dynamic third-party web content is rendered. - Services MUST reject unauthenticated cross-webview IPC events by segregating event listener namespaces using window-specific channel tokens. - Components NEVER invoke Tauri global invoke (`window.__TAURI_INTERNALS__.invoke`) directly without using strongly-typed, auto-generated, isolated command bindings. ## Bad vs Good Implementations ### Tauri 2.0 Capability ACL Configuration #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Using wildcard `windows: ["*"]` grants secondary or dynamically created webviews access to critical mobile capabilities (biometrics, full filesystem, persistent stores), opening vector paths for local privilege escalation. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "ambient-capabilities", "description": "Anti-pattern: Grants all permissions globally across every webview window", "windows": ["*"], "permissions": [ "core:default", "biometric:allow-authenticate", "store:default", "fs:allow-read-all" ] } ``` #### Production Standard (Correct) > **Standard**: Explicitly binds high-privilege native plugins and commands exclusively to the authenticated `main` webview label. Any secondary webview window created at runtime is denied access by default. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "isolated-main-capability", "description": "Restricts sensitive native capabilities strictly to the verified primary mobile webview", "windows": ["main"], "permissions": [ "core:default", "biometric:allow-authenticate", "store:default" ] } ``` ### Rust Command Webview Context Verification #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The Rust command ignores caller provenance. If any secondary webview or compromised renderer can reach the IPC bridge, it executes the privileged operation without boundary checks. ```typescript // Rust Command: src-tauri/src/commands.rs // #[tauri::command] // pub async fn access_secure_vault(payload: String) -> Result<String, String> { // // Flaw: No Webview parameter; any window can execute this command // read_keystore(payload) // } import { invoke } from '@tauri-apps/api/core'; export async function requestSensitiveData(token: string): Promise<string> { // Arbitrary webview invoking unvalidated native command return await invoke<string>('access_secure_vault', { payload: token }); } ``` #### Production Standard (Correct) > **Standard**: Enforces double-sided context validation: the frontend asserts window identity before dispatching, and the native Rust backend strictly inspects `tauri::Webview::label(&webview)` to ensure only the trusted window executes the keystore access. ```typescript // Rust Command: src-tauri/src/commands.rs // #[tauri::command] // pub async fn access_secure_vault( // webview: tauri::Webview, // payload: String // ) -> Result<String, String> { // if webview.label() != "main" { // return Err("IPC_ACCESS_DENIED: Webview context unauthorized".into()); // } // read_keystore(payload) // } import { invoke } from '@tauri-apps/api/core'; import { getCurrentWebview } from '@tauri-apps/api/webview'; export async function requestSensitiveData(token: string): Promise<string> { const current = getCurrentWebview(); if (current.label !== 'main') { throw new Error('Operation not permitted from current webview context.'); } return await invoke<string>('access_secure_vault', { payload: token }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Multi-WebView IPC Isolation & Capability Scoping

Tauri 2.0 Multi-WebView IPC Isolation & Capability Scoping defines an industrial-grade behavioral standard for mobile engineering. Enforces strict window-scoped capability segregation and IPC context isolation across multi-webview Tauri 2.0 mobile architectures. Mandates explicit webview label binding in capability configurations and cryptographic caller validation within Rust command handlers to prevent secondary webviews from invoking privileged native operations. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Ambient Native Exposure via Wildcard IPC Capability Allocation Across WebViews Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Ambient Native Exposure via Wildcard IPC Capability Allocation Across WebViews	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS isolate capabilities per window label inside `src-tauri/capabilities/*.json` using explicit `windows` arrays instead of default wildcard inheritance.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.