Tauri 2.0 Multi-Window Dynamic IPC Channel Sandbox Isolation

--- description: Tauri 2.0 Multi-Window Dynamic IPC Channel Sandbox Isolation - Enforces strict window-scoped capability boundaries and isolated IPC channels across heterogeneous webviews in Tauri 2.0 mobile and desktop environments. Prevents cross-frame event sniffing, privilege escalation, and unauthorized core plugin invocation by isolating permissions strictly through Tauri 2.0 capability manifests and runtime WebviewWindow label validation. globs: src-tauri/capabilities/**/*.json, src-tauri/tauri.conf.json, src-tauri/src/**/*.rs, src/**/*.ts, src/**/*.tsx alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri-v2-multi-window-ipc-sandbox-guardrail" --- # Tauri 2.0 Multi-Window Dynamic IPC Channel Sandbox Isolation > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Global IPC Broadcast and Wildcard Permission Escalation Across Untrusted Heterogeneous Webviews ## System Constraints You are a Principal Security Architect enforcing Tauri 2.0 Multi-Window Dynamic IPC Channel Sandbox Isolation. You must ensure that all IPC command handlers, event emitters, and dynamic WebviewWindow instances strictly adhere to isolated, capability-bound contracts. Prevent cross-origin sniffing, wildcard permissions, and unvalidated origin invocation across mobile/desktop frames. ## Strict Guidelines - Engineers MUST ALWAYS isolate permissions using Tauri 2.0 Capability JSON manifests targeted explicitly to precise window labels (`windows: ["auth-webview", "main"]`) rather than using wildcard asterisks (`windows: ["*"]`). - Engineers MUST NOT emit IPC events using global broadcast methods (`app.emit(...)`) when sending sensitive data; engineers MUST target specific window instances via `app.emit_to(...)` or window-scoped emitter channels. - Command handlers MUST validate the calling window context via `tauri::ipc::Request` or `tauri::WebviewWindow` arguments in Rust before executing privileged native operations. - Frontend components NEVER invoke global IPC channels directly from dynamic or untrusted secondary webview frames without asserting cryptographic session tokens or ephemeral single-use channel nonces. - Services MUST declare granular command access lists (`permissions: ["core:default", "fs:allow-read-text-file"]`) per capability file instead of assigning ambient administrative capabilities across multiple webview frames. ## Bad vs Good Implementations ### Tauri 2.0 Window-Targeted Event Emission and Capability Manifest #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Using app.emit() globally broadcasts the sensitive authentication token to every mounted webview and embedded web frame, allowing malicious or low-privileged secondary webviews to intercept the payload. ```rust // BAD: Global IPC emission leaks sensitive payload to all webview frames use tauri::{AppHandle, Emitter}; #[tauri::command] async fn sync_user_credentials(app: AppHandle, token: String) -> Result<(), String> { // Ambient broadcast vulnerable to cross-window sniffing by untrusted iframes/windows app.emit("auth-token-synced", token) .map_err(|e| e.to_string()) } ``` #### Production Standard (Correct) > **Standard**: The Rust handler inspects the calling WebviewWindow label to verify authority and uses emit_to with the explicit target window label, preventing credential interception across heterogeneous webview contexts. ```rust // GOOD: Explicit window scoping and authenticated window verification use tauri::{AppHandle, Emitter, WebviewWindow}; #[tauri::command] async fn sync_user_credentials( _app: AppHandle, window: WebviewWindow, token: String ) -> Result<(), String> { // Assert origin label matches the designated high-integrity window if window.label() != "main-secure" { return Err("Unauthorized IPC caller: Window lacks capability contract".into()); } // Emit strictly to the designated target window frame window.emit_to("main-secure", "auth-token-synced", token) .map_err(|e| e.to_string()) } ``` ### Dynamic Webview Instantiation with Sandboxed Capabilities (TypeScript) #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Dynamic webviews created without explicit sandbox restrictions and inheriting root capability privileges can trigger native commands across shared backend IPC boundaries. ```typescript // BAD: Creating dynamic webview without isolated scope and executing raw global invoke import { WebviewWindow } from '@tauri-apps/api/webviewWindow'; import { invoke } from '@tauri-apps/api/core'; export async function spawnUntrustedViewer(remoteUrl: string) { const child = new WebviewWindow('untrusted-viewer', { url: remoteUrl, }); // Ambient execution without isolating capability contracts await invoke('execute_privileged_task'); } ``` #### Production Standard (Correct) > **Standard**: Dynamic frames are explicitly isolated with dedicated channel primitives and incognito flags, ensuring zero IPC command overlap with primary app state. ```typescript // GOOD: Isolated capability contract and defensive window instantiation import { WebviewWindow } from '@tauri-apps/api/webviewWindow'; import { Channel } from '@tauri-apps/api/core'; interface IsolatedPayload { readonly status: 'ready' | 'error'; } export async function spawnUntrustedViewer(remoteUrl: string): Promise<WebviewWindow> { const channel = new Channel<IsolatedPayload>(); channel.onmessage = (message) => { if (message.status !== 'ready') { throw new Error('IPC Handshake failed'); } }; return new WebviewWindow('isolated-untrusted-frame', { url: remoteUrl, // Ensure sandboxing invariants for mobile/embedded views incognito: true, acceptFirstMouse: false }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Multi-Window Dynamic IPC Channel Sandbox Isolation

Tauri 2.0 Multi-Window Dynamic IPC Channel Sandbox Isolation defines an industrial-grade behavioral standard for mobile engineering. Enforces strict window-scoped capability boundaries and isolated IPC channels across heterogeneous webviews in Tauri 2.0 mobile and desktop environments. Prevents cross-frame event sniffing, privilege escalation, and unauthorized core plugin invocation by isolating permissions strictly through Tauri 2.0 capability manifests and runtime WebviewWindow label validation. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Global IPC Broadcast and Wildcard Permission Escalation Across Untrusted Heterogeneous Webviews Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Global IPC Broadcast and Wildcard Permission Escalation Across Untrusted Heterogeneous Webviews	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS isolate permissions using Tauri 2.0 Capability JSON manifests targeted explicitly to precise window labels (`windows

Engineers MUST ALWAYS isolate permissions using Tauri 2.0 Capability JSON manifests targeted explicitly to precise window labels (`windows: ["auth-webview", "main"]`) rather than using wildcard asterisks (`windows: ["*"]`).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.