Serve HTML pages with a custom protocol in all project templates by default
- Dominant language
- TypeScript
- Stars
- 7.1k
- Forks
- 641
- Avg merge
- 3d 1h
- Merged PRs (30d)
- 30
Description
### Pre-flight checklist
- [x] I have read the [contribution documentation](https://github.com/electron/forge/blob/main/CONTRIBUTING.md) for this project.
- [x] I agree to follow the [code of conduct](https://github.com/electron/electron/blob/main/CODE_OF_CONDUCT.md) that this project uses.
- [x] I have searched the issue tracker for a feature request that matches the one I want to file, without success.
### Problem description
[The Electron security guidelines discourage the use of the `file://` protocol for serving app pages](https://www.electronjs.org/docs/latest/tutorial/security#18-avoid-usage-of-the-file-protocol-and-prefer-usage-of-custom-protocols), yet the templates still employ this approach by default. This creates extra work for the developer that doesn't know about it (which makes the situation even more dramatic) because a newly created project is expected to be a safe foundation for future work. Moreover, the current situation almost certainly leads to unsafe code reaching production.
### Proposed solution
Serve app pages using a custom protocol instead of the `file://` protocol in all templates used by `create-electron-app`
### Alternatives considered
Solution like "add a warning to the doc" is not even an option when it's possible prevent the problem at all with safe templates
### Additional information
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.