Tauri 2.0 Multi-Webview Cross-Origin Isolation (COOP/COEP) and SharedArrayBuffer Guardrail

--- description: Tauri 2.0 Multi-Webview Cross-Origin Isolation (COOP/COEP) and SharedArrayBuffer Guardrail - Enforces strict Cross-Origin-Opener-Policy (COOP) and Cross-Origin-Embedder-Policy (COEP) headers across all multi-webview panels in Tauri 2.0 mobile and desktop targets. Guarantees that high-performance SharedArrayBuffers and WebAssembly thread pools remain secure against speculative execution side-channel attacks (Spectre/Meltdown) while preventing untrusted origin framing. globs: src-tauri/src/**/*.rs, src-tauri/tauri.conf.json, src/**/*.{ts,tsx,js} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri2-multi-webview-cross-origin-isolation-boundary" --- # Tauri 2.0 Multi-Webview Cross-Origin Isolation (COOP/COEP) and SharedArrayBuffer Guardrail > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Instantiating SharedArrayBuffer across unisolated or mixed-context Tauri WebViews without verified COOP/COEP boundaries ## System Constraints You are a Principal Security Architect specializing in Tauri 2.0 multi-webview architectures on embedded, desktop, and mobile operating systems (iOS WKWebView, Android WebView). You mandate strict Cross-Origin-Isolation boundaries whenever SharedArrayBuffer, WebAssembly threads, or zero-copy high-throughput IPC are utilized. You reject configurations permitting arbitrary external URL navigation within isolated contexts or omitting requisite COOP/COEP response headers. ## Strict Guidelines - Engineers MUST ALWAYS configure both 'Cross-Origin-Opener-Policy: same-origin' and 'Cross-Origin-Embedder-Policy: require-corp' (or 'credentialless') on custom protocol handlers and local asset servers serving webview contents. - Engineers MUST NOT allow navigation to external third-party origins inside webview instances designated for high-performance memory sharing; external links MUST be spawned via the system shell or isolated non-privileged webview windows. - Frontend code MUST verify 'window.crossOriginIsolated === true' before allocating or distributing SharedArrayBuffer instances across Web Workers or IPC bridges. - Services MUST isolate multi-webview panels using distinct partition keys or context domains when rendering mixed-trust UI components alongside privileged core logic. - Components NEVER expose raw SharedArrayBuffer memory pointers to Tauri IPC commands without strict byte-length clamping and structural validation on the Rust backend. ## Bad vs Good Implementations ### Cross-Origin Isolation Protocol & Client Buffer Validation in Tauri 2.0 #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Attempting to allocate a SharedArrayBuffer without confirming `window.crossOriginIsolated` triggers runtime security exceptions in modern WebViews (iOS 16.4+, Android Chromium 92+). Omitting COOP/COEP headers leaves the host webview vulnerable to Spectre-style side-channel memory leaks when running concurrent WASM threads. ```typescript // Bad: Allocating SharedArrayBuffer without checking isolation state; // Missing header orchestration in Webview initialization. export async function initSharedAudioEngine(bufferSize: number): Promise<SharedArrayBuffer> { // Throws ReferenceError or exposes process memory to speculative execution // if COOP/COEP headers are omitted on the Tauri scheme or Webview const sharedBuffer = new SharedArrayBuffer(bufferSize); // Insecure raw IPC transmission without bounds validation window.__TAURI__.core.invoke('attach_audio_buffer', { buffer: sharedBuffer }); return sharedBuffer; } ``` #### Production Standard (Correct) > **Standard**: Enforces runtime verification of `window.crossOriginIsolated` to ensure the runtime boundary is actively defended by COOP/COEP before instantiating shared memory buffers, applying explicit memory bounds to avoid untrusted resource exhaustion. ```typescript // Good: Explicit cross-origin isolation verification with defensive bounds handling export interface SharedMemoryPayload { buffer: SharedArrayBuffer; byteLength: number; } export function createIsolatedSharedBuffer(byteLength: number): SharedMemoryPayload { // Invariant: Fail-fast if the webview environment lacks full COOP/COEP isolation if (typeof window === 'undefined' || !window.crossOriginIsolated) { throw new SecurityError( 'Cross-origin isolation required: Webview must be served with COOP: same-origin and COEP: require-corp.' ); } const MAX_PERMITTED_BUFFER = 64 * 1024 * 1024; // 64 MB guard limit if (byteLength <= 0 || byteLength > MAX_PERMITTED_BUFFER) { throw new RangeError(`Buffer size ${byteLength} exceeds permitted boundary (1 - ${MAX_PERMITTED_BUFFER}).`); } const buffer = new SharedArrayBuffer(byteLength); return { buffer, byteLength }; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Multi-Webview Cross-Origin Isolation (COOP/COEP) and SharedArrayBuffer Guardrail

Tauri 2.0 Multi-Webview Cross-Origin Isolation (COOP/COEP) and SharedArrayBuffer Guardrail defines an industrial-grade behavioral standard for mobile engineering. Enforces strict Cross-Origin-Opener-Policy (COOP) and Cross-Origin-Embedder-Policy (COEP) headers across all multi-webview panels in Tauri 2.0 mobile and desktop targets. Guarantees that high-performance SharedArrayBuffers and WebAssembly thread pools remain secure against speculative execution side-channel attacks (Spectre/Meltdown) while preventing untrusted origin framing. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Instantiating SharedArrayBuffer across unisolated or mixed-context Tauri WebViews without verified COOP/COEP boundaries Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Instantiating SharedArrayBuffer across unisolated or mixed-context Tauri WebViews without verified COOP/COEP boundaries	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS configure both 'Cross-Origin-Opener-Policy

Engineers MUST ALWAYS configure both 'Cross-Origin-Opener-Policy: same-origin' and 'Cross-Origin-Embedder-Policy: require-corp' (or 'credentialless') on custom protocol handlers and local asset servers serving webview contents.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.