Tauri 2.0 Multi-Window IPC Capability Sandboxing Standard

Enforces fine-grained, cryptographically verifiable Access Control Lists (ACL) on inter-process communication (IPC) bridges between multi-window Webview contexts and native host system APIs in Tauri 2.0. Prohibits global wildcard capability bindings and mandates window-scoped, remote-domain-isolated permission manifests to mitigate remote code execution via compromised webview instances. Guarantees that secondary webviews (including OAuth or mobile in-app browser contexts) operate in zero-trust sandboxes without access to native shell, filesystem, or sensitive hardware plugins.

--- description: Tauri 2.0 Multi-Window IPC Capability Sandboxing Standard - Enforces fine-grained, cryptographically verifiable Access Control Lists (ACL) on inter-process communication (IPC) bridges between multi-window Webview contexts and native host system APIs in Tauri 2.0. Prohibits global wildcard capability bindings and mandates window-scoped, remote-domain-isolated permission manifests to mitigate remote code execution via compromised webview instances. Guarantees that secondary webviews (including OAuth or mobile in-app browser contexts) operate in zero-trust sandboxes without access to native shell, filesystem, or sensitive hardware plugins. globs: src-tauri/capabilities/**/*.json, src-tauri/tauri.conf.json, src/**/*.{ts,tsx,js,jsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri-v2-multiwindow-ipc-sandboxing-standard" --- # Tauri 2.0 Multi-Window IPC Capability Sandboxing Standard > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Assigning global wildcard permission capabilities to all webview labels and executing unscoped IPC invocations across privileged and unprivileged windows ## System Constraints You are a Principal Security Architect enforcing the Tauri 2.0 Multi-Window IPC Capability Sandboxing Standard. Mandate that every IPC command and Tauri plugin invocation adheres strictly to Tauri 2.0's granular capability ACL architecture. Forbid wildcard permissions (e.g., 'core:default', 'fs:*', or 'shell:*') applied globally across all window labels. Require explicit window scoping ('windows: ["main"]') in src-tauri/capabilities/*.json manifests. Ensure unprivileged secondary windows, webviews, and mobile OAuth WebViews inherit an explicit zero-trust capability profile denying access to native host shell, raw socket operations, or unconstrained filesystem access. ## Strict Guidelines - Engineers MUST ALWAYS isolate distinct UI contexts into discrete capability JSON files under 'src-tauri/capabilities/' mapped to specific window labels. - Engineers MUST NOT map sensitive permissions ('core:path:default', 'fs:allow-*', 'shell:allow-*') to wildcard window targets ('*'). - Services MUST validate caller window labels and execution contexts within custom native Rust command handlers via 'tauri::ipc::Request' or 'tauri::WebviewWindow' handles. - Components NEVER execute raw IPC calls via global '__TAURI_INTERNALS__' or untyped invoke signatures without payload schema validation. - Mobile and secondary pop-up webviews MUST be explicitly assigned isolated capability files with empty or strictly read-only permission sets. - Engineers MUST utilize cryptographically scoped permissions (e.g., explicit path ACL allowlists) instead of broad plugin defaults in mobile deployments. ## Bad vs Good Implementations ### Tauri 2.0 Capability Manifest - Wildcard Binding vs Window-Scoped ACL #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Assigning 'windows: ["*"]' grants sensitive host permissions (filesystem and shell execution) to all windows, including insecure secondary webviews, auth popups, and embedded external webviews, resulting in arbitrary host compromise if any webview is exploited. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "default-capability", "description": "Anti-pattern: Universal capability assigned to all windows", "windows": ["*"], "permissions": [ "core:default", "fs:default", "shell:default" ] } ``` #### Production Standard (Correct) > **Standard**: Explicitly binds permissions exclusively to the 'main' window label and applies fine-grained path allowlists for the filesystem plugin, enforcing sandboxing and blocking privilege escalation from untrusted windows. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "main-window-capability", "description": "Scoped capability strictly assigned to the authenticated main window", "windows": ["main"], "permissions": [ "core:default", { "identifier": "fs:allow-read-text-file", "allow": [ { "path": "$APPDATA/secure_store/*" } ] } ] } ``` ### TypeScript Multi-Window IPC Invocation Sandboxing #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Lacks window context awareness and validation; invoking an unscoped command from secondary or mobile in-app webviews assumes high host privileges without asserting caller origin. ```typescript import { invoke } from '@tauri-apps/api/core'; // Bad: Invoking high-privilege IPC command from an arbitrary or child window export async function exportUserData(filePath: string) { return await invoke('export_secure_data', { targetPath: filePath }); } ``` #### Production Standard (Correct) > **Standard**: Validates the executing window's label at runtime prior to dispatching IPC calls, preventing compromised child contexts or webviews from dispatching privileged host commands. ```typescript import { invoke } from '@tauri-apps/api/core'; import { getCurrentWebviewWindow } from '@tauri-apps/api/webviewWindow'; export async function exportUserData(fileName: string): Promise<{ success: boolean }> { const currentWindow = getCurrentWebviewWindow(); if (currentWindow.label !== 'main') { throw new Error(`Security Exception: Window '${currentWindow.label}' is not authorized to invoke exportUserData.`); } // Validate input parameters against strict sanitized schemas before IPC dispatch const sanitizedFileName = fileName.replace(/[^a-zA-Z0-9._-]/g, ''); return await invoke<{ success: boolean }>('export_secure_data', { fileName: sanitizedFileName }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Multi-Window IPC Capability Sandboxing Standard

Tauri 2.0 Multi-Window IPC Capability Sandboxing Standard defines an industrial-grade behavioral standard for mobile engineering. Enforces fine-grained, cryptographically verifiable Access Control Lists (ACL) on inter-process communication (IPC) bridges between multi-window Webview contexts and native host system APIs in Tauri 2.0. Prohibits global wildcard capability bindings and mandates window-scoped, remote-domain-isolated permission manifests to mitigate remote code execution via compromised webview instances. Guarantees that secondary webviews (including OAuth or mobile in-app browser contexts) operate in zero-trust sandboxes without access to native shell, filesystem, or sensitive hardware plugins. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Assigning global wildcard permission capabilities to all webview labels and executing unscoped IPC invocations across privileged and unprivileged windows Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Assigning global wildcard permission capabilities to all webview labels and executing unscoped IPC invocations across privileged and unprivileged windows	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS isolate distinct UI contexts into discrete capability JSON files under 'src-tauri/capabilities/' mapped to specific window labels.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.