Security configuration
Permission allowlisting, Content-Security-Policy, and how secureStorage names its keys on disk — everything under security in electron.config.ts. This page covers the config keys; see Architecture for the IPC sender-trust mechanism and navigation hardening these settings sit on top of.
Why this exists
Unlike a plain browser, Electron's own default is to silently allow every permission request (camera, microphone, geolocation, notifications, ...) and to let any window navigate or pop up anywhere. This package overrides both defaults unconditionally, regardless of what you set here:
- Permission requests are denied unless explicitly allowlisted via
security.allowedPermissions. - The main window cannot navigate away from its own origin or open unrestricted new windows —
window.open/target="_blank"are denied outright. Usewindow.Electron.windows.create()instead.
Keys
| Key | Purpose |
|---|---|
security.allowedPermissions |
Permission-name allowlist (Electron's permission strings: 'camera', 'microphone', 'geolocation', 'notifications', 'midi', 'midiSysex', 'pointerLock', 'fullscreen', 'openExternal', 'display-capture', ...). Everything else is denied. Default [] (deny everything). |
security.csp |
Content-Security-Policy. A string is used verbatim as the header value; an object ({ directive: 'source source2' }) is assembled into a CSP string; false disables CSP entirely (not recommended for production). Omit for sensible defaults — loose in dev, strict in prod. |
security.secureStorageKeys |
'plain' (default) keeps original key names — values are still encrypted with Electron's safeStorage. 'hashed' stores deterministic SHA-256 key hashes instead; original key names aren't stored, so secureStorage.keys() then rejects instead of returning unusable hashes. Existing data is not migrated automatically when you switch modes. |
Example
security: {
allowedPermissions: ['notifications'],
csp: {
'default-src': "'self'",
'img-src': "'self' data:",
},
},
Enable only the permissions your app actually asks for — e.g. ['notifications'] if it shows OS notifications, nothing more.
Next: App & lifecycle · UI configuration · Processes configuration