AgentRules.org
RulesStacksClientsAuditorPrunerSelf-HealRFCsBenchmarkCLICI/CDAuthorsSubmit
This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →
mobilecritical PriorityID: tauri2-multi-webview-ipc-capability-scoping-guardrail

Tauri 2.0 Multi-Webview IPC Capability Scoping & ACL Isolation

Enforces strict origin-bound Access Control Lists (ACLs) and capability isolation across multi-webview and dynamic window architectures in Tauri 2.0 mobile and desktop targets. Eliminates native privilege escalation vectors by binding discrete IPC permissions exclusively to deterministic webview labels and cryptographically validated remote or local origins.

Prohibited Anti-Pattern: Wildcard Capability Mapping and Unpartitioned Window IPC Binding

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: Tauri 2.0 Multi-Webview IPC Capability Scoping & ACL Isolation - Enforces strict origin-bound Access Control Lists (ACLs) and capability isolation across multi-webview and dynamic window architectures in Tauri 2.0 mobile and desktop targets. Eliminates native privilege escalation vectors by binding discrete IPC permissions exclusively to deterministic webview labels and cryptographically validated remote or local origins.
globs: src-tauri/capabilities/**/*.json, src-tauri/tauri.conf.json, src-tauri/src/**/*.rs, src/**/*.{ts,tsx}
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/tauri2-multi-webview-ipc-capability-scoping-guardrail"
---

# Tauri 2.0 Multi-Webview IPC Capability Scoping & ACL Isolation

> **Severity**: CRITICAL | **Category**: mobile
> **Anti-Pattern Warning**: Wildcard Capability Mapping and Unpartitioned Window IPC Binding

## System Constraints
You are a Principal Security Architect enforcing Tauri 2.0 Multi-Webview IPC Capability Scoping Guardrails. Tauri 2.0 deprecated monolithic allowlists in favor of a fine-grained, origin-aware capability and permissions model. You must mandate that every dynamic webview, modal window, and embedded frame declares an explicit capability partition. Wildcard window assignments (`["*"]`) combined with privileged native commands (e.g., shell execution, unrestrained filesystem access, native biometric bypass) are strictly rejected. All dynamic webviews must use distinct, cryptographically attested labels and isolated IPC channels.

## Strict Guidelines
- Engineers MUST ALWAYS isolate Tauri 2.0 capabilities into dedicated JSON/TOML files under `src-tauri/capabilities/` scoped to specific window and webview labels (e.g., `windows: ["main"]`, `windows: ["auth-webview"]`).
- Engineers MUST NOT declare wildcard window targets (`windows: ["*"]`) in capabilities granting high-privilege native access (e.g., `fs:*`, `shell:*`, `process:*`).
- Engineers MUST explicit define remote domain allowances with exact cryptographic protocol constraints (`https://`) and sub-path limits when webviews host non-local assets.
- Rust backend command implementations MUST validate the calling webview label via `tauri::Webview` or `tauri::WebviewWindow` before executing privileged native operations.
- Dynamic webview creation from frontend TypeScript MUST declare explicit, non-overlapping window labels and configure `dragDropEnabled: false`, minimal `permissionScope`, and restricted IPC bindings.
- Secondary webviews (e.g., OAuth authentication flows, in-app browser modals) MUST NEVER be assigned native execution capabilities beyond essential callback emission.

## Bad vs Good Implementations
### Tauri 2.0 Capability Configuration: Wildcard vs Label-Scoped ACL

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Assigning 'windows': ['*'] grants high-privilege native capabilities (like 'shell:allow-execute' and write access) to any secondary webview or dynamically loaded window. If 'external-viewer' loads remote content or is compromised via XSS, an attacker can escalate directly to arbitrary host execution.
```typescript
// src-tauri/capabilities/default.json (ANTI-PATTERN)
// Grants unrestrained native shell and filesystem privileges to ALL windows and webviews
const badCapability = {
  "$schema": "../gen/schemas/desktop-schema.json",
  "identifier": "default-capability",
  "description": "Shared capability for entire app",
  "windows": ["*"],
  "permissions": [
    "core:default",
    "shell:allow-execute",
    "fs:allow-read-text-file",
    "fs:allow-write-text-file"
  ]
};

// Secondary webview creation inherits all core/shell capabilities
import { WebviewWindow } from '@tauri-apps/api/webviewWindow';
export function spawnExternalBrowser(url: string) {
  return new WebviewWindow('external-viewer', {
    url,
    // Inherits '*' capability with shell:allow-execute vulnerability
  });
}
```

#### Production Standard (Correct)
> **Standard**: Capabilities are partitioned into discrete, non-wildcard files. The 'external-viewer' webview is explicitly granted only harmless event listening, strictly denying filesystem, shell, and dangerous core IPC operations even if an attacker controls the remote content.
```typescript
// src-tauri/capabilities/external-viewer.json (STRICT PARTITION)
// {
//   "$schema": "../gen/schemas/desktop-schema.json",
//   "identifier": "external-viewer-capability",
//   "description": "Zero-trust capability strictly for external content",
//   "windows": ["external-viewer"],
//   "permissions": [
//     "core:event:allow-listen"
//   ]
// }

// src/lib/webviewManager.ts
import { WebviewWindow } from '@tauri-apps/api/webviewWindow';
import { invoke } from '@tauri-apps/api/core';

export async function spawnExternalBrowser(targetUrl: string): Promise<WebviewWindow> {
  const parsed = new URL(targetUrl);
  if (parsed.protocol !== 'https:') {
    throw new Error('Only secure HTTPS origins are permitted for isolated webviews');
  }

  // Window label strictly matches the sandboxed capability manifest
  const viewer = new WebviewWindow('external-viewer', {
    url: parsed.toString(),
    title: 'Isolated Viewer',
    width: 600,
    height: 800,
    dragDropEnabled: false,
    incognito: true
  });

  await viewer.once('tauri://error', (err) => {
    console.error('Webview initialization failed:', err);
  });

  return viewer;
}
```
Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

Tauri Security Analyzer MCP
Validates Tauri 2.0 capabilities, ACL manifests, and Rust IPC handlers against privilege escalation vectors.
Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

Tauri CLI Capability Auditor
Performs static validation of Tauri 2.0 permissions and capability configurations to catch unisolated webviews before release.
Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Multi-Webview IPC Capability Scoping & ACL Isolation

Tauri 2.0 Multi-Webview IPC Capability Scoping & ACL Isolation defines an industrial-grade behavioral standard for mobile engineering. Enforces strict origin-bound Access Control Lists (ACLs) and capability isolation across multi-webview and dynamic window architectures in Tauri 2.0 mobile and desktop targets. Eliminates native privilege escalation vectors by binding discrete IPC permissions exclusively to deterministic webview labels and cryptographically validated remote or local origins. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Wildcard Capability Mapping and Unpartitioned Window IPC Binding Without an explicit system instruction file, developers spend hours debugging silent failures.
Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure ModeAI Symptom (The Anti-Pattern)SeverityProduction Impact & Remedy
AI Hallucination & Deprecation DriftWildcard Capability Mapping and Unpartitioned Window IPC BindingCritical
Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production.
Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture InconsistencyAI assistants produce mixed paradigms across files, creating fragmented codebase conventions.Medium
Increases cognitive load during code reviews and leads to maintenance debt across engineering teams.
Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.
Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Engineers MUST ALWAYS isolate Tauri 2.0 capabilities into dedicated JSON/TOML files under `src-tauri/capabilities/` scoped to specific window and webview labels (e.g., `windows

Engineers MUST ALWAYS isolate Tauri 2.0 capabilities into dedicated JSON/TOML files under `src-tauri/capabilities/` scoped to specific window and webview labels (e.g., `windows: ["main"]`, `windows: ["auth-webview"]`).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
2

Engineers MUST NOT declare wildcard window targets (`windows

Engineers MUST NOT declare wildcard window targets (`windows: ["*"]`) in capabilities granting high-privilege native access (e.g., `fs:*`, `shell:*`, `process:*`).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
3

Engineers MUST explicit define remote domain allowances with exact cryptographic protocol constraints (`https

Engineers MUST explicit define remote domain allowances with exact cryptographic protocol constraints (`https://`) and sub-path limits when webviews host non-local assets.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
4

Rust backend command implementations MUST validate the calling webview label via `tauri

Rust backend command implementations MUST validate the calling webview label via `tauri::Webview` or `tauri::WebviewWindow` before executing privileged native operations.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
5

Dynamic webview creation from frontend TypeScript MUST declare explicit, non-overlapping window labels and configure `dragDropEnabled

Dynamic webview creation from frontend TypeScript MUST declare explicit, non-overlapping window labels and configure `dragDropEnabled: false`, minimal `permissionScope`, and restricted IPC bindings.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
6

Secondary webviews (e.g., OAuth authentication flows, in-app browser modals) MUST NEVER be assigned native execution capabilities beyond essential callback emission.

Secondary webviews (e.g., OAuth authentication flows, in-app browser modals) MUST NEVER be assigned native execution capabilities beyond essential callback emission.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is Tauri 2.0 Multi-Webview IPC Capability Scoping & ACL Isolation critical for AI coding assistants?

Enforces strict origin-bound Access Control Lists (ACLs) and capability isolation across multi-webview and dynamic window architectures in Tauri 2.0 mobile and desktop targets. Eliminates native privilege escalation vectors by binding discrete IPC permissions exclusively to deterministic webview labels and cryptographically validated remote or local origins. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Wildcard Capability Mapping and Unpartitioned Window IPC Binding) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related MOBILE Rules

View all rules →
mobile
106

Tauri 2.0 Mobile IPC & Capabilities Permissions Matrix Standard

Tauri v2 introduces a capability-driven permissions system replacing legacy v1 allowlists across iOS and Android runtimes. Failure to constrain IPC command handlers with typed schemas and explicit mobile capability definitions exposes native mobile OS surfaces to arbitrary code execution, permission leakage, and silent serialization failures. Production mobile deployments require strictly typed IPC boundary validation, granular capability scopes, and graceful permission degradation.

mobile
70

Capacitor 7 Native Bridge, Biometric Auth & Android 15 Lifecycle Production Standard

Capacitor 7 enforces strict bridge lifecycle contracts, asynchronous native plugin interop, and mandatory Android 15 edge-to-edge window inset handling. Storing sensitive authentication tokens in unencrypted web storage or failing to bind biometric authentication directly to hardware-backed Keystore or Secure Enclave mechanisms compromises app integrity and causes fatal crash or viewport occlusion issues on modern mobile operating systems.

mobile
58

Tauri 2.0 Mobile IPC Isolation and Capabilities Permission Scoping

Enforces strict capability permission boundaries, payload validation, and secure IPC invoke scoping for Tauri v2 Android and iOS environments. Prevents arbitrary IPC command execution, excessive native privilege granting, and deserialization vulnerabilities across the mobile webview-native boundary.

1 Rule in Stack

Tauri