Tauri 2.0 Webview Window Isolation & IPC Capability Sandboxing

--- description: Tauri 2.0 Webview Window Isolation & IPC Capability Sandboxing - Enforces granular per-window IPC capability manifests in Tauri 2.0 mobile and multi-webview architectures. Restricts OS-level plugin access, native invoke commands, and IPC events to explicitly bound window labels, preventing untrusted or auxiliary webviews from escalating privileges to host operating system APIs. globs: src-tauri/capabilities/**/*.json, src-tauri/tauri.conf.json, src/**/*.{ts,tsx}, src-tauri/src/**/*.rs alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri-v2-multiwindow-ipc-capability-sandboxing" --- # Tauri 2.0 Webview Window Isolation & IPC Capability Sandboxing > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Wildcard window capability assignments and unpartitioned IPC commands enabling cross-window privilege escalation. ## System Constraints You are a Principal Security Architect enforcing Tauri 2.0 Multi-Window Webview IPC Capability Sandboxing. Mandate strict window isolation, granular capability JSON manifests, caller window verification in native commands, and zero-trust secondary webviews. ## Strict Guidelines - Engineers MUST ALWAYS declare isolated capability configuration files per window role under `src-tauri/capabilities/` and explicitly list window identifiers instead of wildcards. - Engineers MUST NOT assign sensitive OS plugins (fs, shell, biometric, deep-link, process) to auxiliary, authentication, or external webview instances. - Native Rust command handlers MUST inspect caller identity via `tauri::Webview` or `tauri::Window` labels when executing privileged side-effects. - Services MUST gracefully handle capability permission denials (`CommandNotFound` or permission errors) on secondary webview frontends. - Components NEVER trigger privileged OS-level plugin calls from dynamically injected or external webview contexts. ## Bad vs Good Implementations ### Granular Window Creation and Sandboxed Invoke Execution #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Creates a secondary webview that inherits unbounded global default permissions and handles sensitive host tokens across unisolated webview boundaries without validating window context or enforcing isolated capabilities. ```typescript import { invoke } from '@tauri-apps/api/core'; import { WebviewWindow } from '@tauri-apps/api/webviewWindow'; // ANTI-PATTERN: Spawning secondary window without security boundaries // Assumes default capabilities give all windows raw FS and IPC access export async function openAuthPortal(authUrl: string) { const authWindow = new WebviewWindow('auth-window', { url: authUrl, // Inherits broad default permissions; vulnerable if redirected }); authWindow.once('tauri://created', async () => { // Exposes native system calls to arbitrary webview contexts const token = await invoke<string>('read_secure_token'); await authWindow.emit('token-ready', { token }); }); } ``` #### Production Standard (Correct) > **Standard**: Binds auxiliary webviews to explicit capability contexts, preventing privilege escalation. The frontend handles permission rejections from capability-sandboxed native plugins gracefully. ```typescript import { invoke } from '@tauri-apps/api/core'; import { WebviewWindow } from '@tauri-apps/api/webviewWindow'; // PRODUCTION FIX: Sandboxed window creation with restricted capabilities export async function openAuthPortal(authUrl: string): Promise<WebviewWindow> { // Window label 'auth-portal' is mapped to a strictly scoped capability file // in `src-tauri/capabilities/auth-portal.json` denying raw filesystem and shell const authWindow = new WebviewWindow('auth-portal', { url: authUrl, incognito: true, acceptFirstMouse: false }); authWindow.once('tauri://error', (e) => { console.error('Auth webview initialization error:', e); }); return authWindow; } export async function fetchWindowScopedData(): Promise<string | null> { try { // Privileged command will fail with permission error if called from 'auth-portal' return await invoke<string>('plugin:secure-storage|read_token'); } catch (error: unknown) { console.warn('Execution blocked by Tauri capability sandbox:', error); return null; } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Webview Window Isolation & IPC Capability Sandboxing

Tauri 2.0 Webview Window Isolation & IPC Capability Sandboxing defines an industrial-grade behavioral standard for mobile engineering. Enforces granular per-window IPC capability manifests in Tauri 2.0 mobile and multi-webview architectures. Restricts OS-level plugin access, native invoke commands, and IPC events to explicitly bound window labels, preventing untrusted or auxiliary webviews from escalating privileges to host operating system APIs. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Wildcard window capability assignments and unpartitioned IPC commands enabling cross-window privilege escalation. Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Wildcard window capability assignments and unpartitioned IPC commands enabling cross-window privilege escalation.	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS declare isolated capability configuration files per window role under `src-tauri/capabilities/` and explicitly list window identifiers instead of wildcards.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.