Hardening Against Remote Content Risks
Protect your Electron app from threats introduced by remote or untrusted web content using webSecurity, CSP, and navigation controls, building on isolation and sandboxing.
Hardening Against Remote Content Risks is a free Electron Desktop App Development lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Electron Desktop App Development learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
The Danger of Remote Content
Loading remote URLs or untrusted HTML can expose your app to cross-site scripting and code execution. Hardening is essential.
Prefer Local Content
The safest app loads only local files you control. Treat any remote content as hostile until proven otherwise.
Keep webSecurity On
Never disable webSecurity. It enforces the same-origin policy inside your renderer.
new BrowserWindow({
webPreferences: {
webSecurity: true
}
});Content Security Policy
A CSP restricts what scripts and resources can load, blocking injected code.
<meta http-equiv="Content-Security-Policy" content="default-src 'self'">Validating a CSP
A strict CSP avoids unsafe-inline and unsafe-eval. You can lint your policy programmatically.
function isStrict(csp) {
return !csp.includes('unsafe-inline') && !csp.includes('unsafe-eval');
}
console.log(isStrict("default-src 'self'"));Controlling Navigation
Block unexpected navigation with the will-navigate event, allowing only your trusted origins.
function allowed(url) {
return url.startsWith('https://myapp.example.com');
}
console.log(allowed('https://evil.com'));Blocking New Windows
Intercept setWindowOpenHandler to deny or vet any attempt to open new windows from content.
contents.setWindowOpenHandler(({ url }) => {
return { action: allowed(url) ? 'allow' : 'deny' };
});Opening Links Safely
Send external links to the OS browser with shell.openExternal instead of loading them inside your app.
Disable Unused Permissions
Use a setPermissionRequestHandler to deny camera, geolocation, and other requests your app does not need.
session.setPermissionRequestHandler((wc, perm, cb) => {
cb(perm === 'notifications');
});Avoid Disabling Protections
Flags like allowRunningInsecureContent and nodeIntegration: true on remote content are dangerous. Keep defaults.
Audit Regularly
Run Electron's security checklist and keep Electron updated to inherit Chromium's latest patches.
Quick Check
Test your remote-content hardening knowledge.
Recap
You learned to harden against remote content: prefer local files, keep webSecurity on, enforce a strict CSP, control navigation and window opening, deny unneeded permissions, and audit regularly.
Frequently asked questions
Is the “Hardening Against Remote Content Risks” lesson free?
Yes — the full text of “Hardening Against Remote Content Risks” is free to read here on the web, and the Electron Desktop App Development course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Electron Desktop App Development course, upgrade to CoddyKit PRO.
What will I learn in “Hardening Against Remote Content Risks”?
Protect your Electron app from threats introduced by remote or untrusted web content using webSecurity, CSP, and navigation controls, building on isolation and sandboxing. You practise Electron Desktop App Development with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Electron Desktop App Development?
No prior experience is required. Electron Desktop App Development on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Hardening Against Remote Content Risks” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Electron Desktop App Development lesson?
Yes. Every Electron Desktop App Development lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Secure IPC Patterns
- Context Isolation & Preload Scripts
- Sandboxing Renderer Process
- Hardening Against Remote Content Risks