Tauri 2.0 Webview Scoped IPC Capability & Origin Isolation Standard

--- description: Tauri 2.0 Webview Scoped IPC Capability & Origin Isolation Standard - Enforces strict capability-based access control and origin isolation for Tauri 2.0 IPC bridges. Host-level Rust commands and native plugin APIs must be locked down to verified local origins with zero-trust capability files, preventing Remote Code Execution (RCE) via untrusted web assets or compromised remote origins. globs: src-tauri/capabilities/**/*.json, src-tauri/tauri.conf.json, src/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri-v2-scoped-ipc-capability-allowlist" --- # Tauri 2.0 Webview Scoped IPC Capability & Origin Isolation Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Unscoped IPC capabilities granting native Rust execution to wildcard windows or remote origins. ## System Constraints You are a Principal Security Architect enforcing the Tauri 2.0 Webview Scoped IPC Plugin Allowlist Standard. Tauri 2.0 replaces the v1 global allowlist with an explicit capability and permission model. You must ensure that no dangerous native commands or plugins are exposed to unauthorized windows or remote origins. Mandate granular capability JSON configurations, strict window label scoping, and zero-trust frontend IPC abstractions. ## Strict Guidelines - Engineers MUST ALWAYS isolate native plugin permissions (e.g., `fs`, `shell`, `http`, `opener`) to explicit window labels using granular capability files under `src-tauri/capabilities/`. - Engineers MUST NOT grant wildcard window capabilities (`windows: ["*"]`) when exposing privileged native command scopes. - Capabilities MUST explicitly isolate remote contexts by prohibiting IPC bridges on windows displaying external origins, enforcing `remote: { urls: [] }` or omitting remote scopes entirely. - Engineers MUST NOT enable dangerous execution permissions like `shell:allow-execute` without rigorous argument regex validation and strict host-level Rust guards. - Security configurations in `tauri.conf.json` MUST enforce a hardened Content Security Policy (CSP) restricting script execution strictly to local app bundles (`tauri:` or `asset:`) with `object-src 'none'`. ## Bad vs Good Implementations ### Tauri 2.0 Capability Declaration (Vulnerable Wildcard vs Scoped Isolation) #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Using wildcard windows ('*') and broad permissions like 'shell:allow-execute' or 'fs:default' allows any window, third-party iframe, or loaded remote URL to execute arbitrary shell commands and filesystem actions on the host machine. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "default-capability", "description": "Insecure: grants full native access across all windows and remote origins", "windows": ["*"], "permissions": [ "core:default", "shell:default", "shell:allow-execute", "fs:default" ] } ``` #### Production Standard (Correct) > **Standard**: Explicitly binds capabilities to the 'main' window label only, disallows remote URL IPC access, and grants least-privilege filesystem reads limited exclusively to a single application configuration file. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "main-window-capability", "description": "Secure: scoped strictly to verified local main window with granular permissions", "windows": ["main"], "permissions": [ "core:default", { "identifier": "fs:allow-read-text-file", "allow": [ { "path": "$APPDATA/config.json" } ] } ], "remote": { "urls": [] } } ``` ### Frontend IPC Invocation (Unchecked Dynamic Invoke vs Schema-Validated Client) #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Accepting dynamic command names and arbitrary payloads bypasses compile-time IPC guarantees and exposes the host bridge to prototype pollution or unexpected remote command execution. ```typescript import { invoke } from '@tauri-apps/api/core'; // Insecure: invoking dynamic host commands from external or unsanitized input export async function runDynamicCommand(commandName: string, payload: unknown) { return await invoke(commandName, { payload }); } ``` #### Production Standard (Correct) > **Standard**: Restricts invoke calls to explicitly mapped, compile-time verified plugin command names and validates input parameters using strict runtime schemas prior to IPC dispatch. ```typescript import { invoke } from '@tauri-apps/api/core'; import { z } from 'zod'; const AppConfigPayloadSchema = z.object({ configKey: z.enum(['theme', 'locale', 'telemetry']), }); type AppConfigPayload = z.infer<typeof AppConfigPayloadSchema>; // Secure: strictly typed command name and validated input boundary export async function fetchAppConfig(payload: AppConfigPayload): Promise<string> { const validated = AppConfigPayloadSchema.parse(payload); return await invoke<string>('plugin:app-settings|get_config', { key: validated.configKey, }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Webview Scoped IPC Capability & Origin Isolation Standard

Tauri 2.0 Webview Scoped IPC Capability & Origin Isolation Standard defines an industrial-grade behavioral standard for security engineering. Enforces strict capability-based access control and origin isolation for Tauri 2.0 IPC bridges. Host-level Rust commands and native plugin APIs must be locked down to verified local origins with zero-trust capability files, preventing Remote Code Execution (RCE) via untrusted web assets or compromised remote origins. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Unscoped IPC capabilities granting native Rust execution to wildcard windows or remote origins. Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Unscoped IPC capabilities granting native Rust execution to wildcard windows or remote origins.	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS isolate native plugin permissions (e.g., `fs`, `shell`, `http`, `opener`) to explicit window labels using granular capability files under `src-tauri/capabilities/`.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.