Security warning in the console of BrowserWindow (electron ^9.2.0)

user_8684521 0
Viewed 9318

I am new to electron and I am getting this in the console (of DevTools) of every BrowserWindow I open:

webFrame.executeJavaScript was called without worldSafeExecuteJavaScript enabled. This is considered unsafe. worldSafeExecuteJavaScript will be enabled by default in Electron 12.

I am also getting one more security warning and that is:

Electron Security Warning (Insecure Content-Security-Policy) This renderer process has either no Content Security
    Policy set or a policy with "unsafe-eval" enabled. This exposes users of
    this app to unnecessary security risks.

I don't know what exactly I am doing wrong...!!

This is my console window

This is my package.json

electron javascript
2 Answers

webFrame.executeJavaScript and contextIsolation

Add the following setting to your BrowserWindow in main.js

webPreferences { worldSafeExecuteJavaScript: true, contextIsolation: true }

For reference, see:

Insecure Content-Security-Policy

Add the following to the head of your index.html and any other html pages if you are loading locally

<meta http-equiv="Content-Security-Policy" content="script-src 'self'">

For reference, see:

user_87868370

First add a CSP policy, like this one:

    <meta http-equiv="Content-Security-Policy" content="default-src 'self'">

This may break some scripts, but it's better to do this. Also you can enable unsafe-inline

  1. See electron's security recommendations
user_117402690
Related