electron / electron/forge

Serve HTML pages with a custom protocol in all project templates by default

Open
#4,099 1 comment 22 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
7.1k
Forks
641
Avg merge
3d 1h
Merged PRs (30d)
30

Description

### Pre-flight checklist

- [x] I have read the [contribution documentation](https://github.com/electron/forge/blob/main/CONTRIBUTING.md) for this project.
- [x] I agree to follow the [code of conduct](https://github.com/electron/electron/blob/main/CODE_OF_CONDUCT.md) that this project uses.
- [x] I have searched the issue tracker for a feature request that matches the one I want to file, without success.

### Problem description

[The Electron security guidelines discourage the use of the `file://` protocol for serving app pages](https://www.electronjs.org/docs/latest/tutorial/security#18-avoid-usage-of-the-file-protocol-and-prefer-usage-of-custom-protocols), yet the templates still employ this approach by default. This creates extra work for the developer that doesn't know about it (which makes the situation even more dramatic) because a newly created project is expected to be a safe foundation for future work. Moreover, the current situation almost certainly leads to unsafe code reaching production.

### Proposed solution

Serve app pages using a custom protocol instead of the `file://` protocol in all templates used by `create-electron-app`

### Alternatives considered

Solution like "add a warning to the doc" is not even an option when it's possible prevent the problem at all with safe templates

### Additional information

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.