Enum SecretStorage 

#[non_exhaustive]
pub enum SecretStorage {
    Auto,
    Mock,
    System,
}

Which key Chromium uses to encrypt the little it stores encrypted.

Chromium’s os_crypt layer encrypts cookies and saved passwords only. Every other piece of web storage — localStorage, IndexedDB, Cache Storage, service worker registrations — is written to the cache directory unencrypted whichever variant you pick here, exactly as it is under wry’s WebKitGTK and WebView2 backends.

The default, SecretStorage::Auto, skips the OS secret store in development builds (tauri::is_dev()) and keeps it in release builds. What it skips differs per platform:

• on macOS, os_crypt stores a random key in a shared “Chromium Safe Storage” keychain item whose ACL is bound to the code signature of the process that reads it. Ad-hoc-signed development builds get a new signature on every rebuild, so macOS puts up the keychain password prompt again after every cargo build.
• on Linux, os_crypt asks the D-Bus secret portal, libsecret or KWallet for the key, which pops a keyring-unlock dialog the first time an app runs.

A release build that has to run where there is no secret store at all — a headless session, a container, a CI image — needs SecretStorage::Mock, because there Auto asks for a store that is not there.

Security

The mock keychain (--use-mock-keychain) and the Linux basic password store do not derive a secret key: they encrypt with a key derived from a hard-coded constant compiled into Chromium (mock_password and peanuts respectively). Both constants are public, so cookies encrypted with them have no meaningful protection at rest — anyone who can read the cache directory can decrypt them.

Switching modes invalidates stored cookies

Cookies encrypted with one key cannot be read back with another, and development and release builds share the same default cache directory ({user cache}/{identifier}/cef). Moving an app between SecretStorage::Mock and SecretStorage::System — including the implicit move SecretStorage::Auto makes when a dev build is followed by a release build — therefore drops the cookies stored under the previous key, logging users out. Set Cef::root_cache_path to separate the two if that matters.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Auto

Skip the OS secret store in development builds (tauri::is_dev()) and use it in release builds: --use-mock-keychain on macOS and --password-store=basic on Linux, in development only. Windows is untouched and keeps using DPAPI.

Mock

Always encrypt with Chromium’s hard-coded constant: --use-mock-keychain on macOS, --password-store=basic on Linux. Windows is untouched and keeps using DPAPI.

Read the security note on SecretStorage before shipping this in a release build: the key is a public constant, so the cookie jar is effectively unprotected.

System

Always use the operating system secret store, on every platform and in every build profile. Appends no switch at all.

Trait Implementations

impl Clone for SecretStorage

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for SecretStorage

impl Debug for SecretStorage

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecretStorage

fn default() -> Self

Returns the “default value” for a type.

impl Eq for SecretStorage

impl PartialEq for SecretStorage

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for SecretStorage