Struct SecurityConfig 

pub struct SecurityConfig {
    pub csp: Option<Csp>,
    pub dev_csp: Option<Csp>,
    pub freeze_prototype: bool,
    pub dangerous_disable_asset_csp_modification: DisabledCspModificationKind,
    pub asset_protocol: AssetProtocolConfig,
    pub pattern: PatternKind,
    pub capabilities: Vec<CapabilityEntry>,
    pub headers: Option<HeaderConfig>,
}

Security configuration.

See more: https://v2.tauri.app/reference/config/#securityconfig

Fields

csp: Option<Csp>

The Content Security Policy that will be injected on all HTML files on the built application. If devCsp is not specified, this value is also injected on dev.

This is a really important part of the configuration since it helps you ensure your WebView is secured. See https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP.

dev_csp: Option<Csp>

The Content Security Policy that will be injected on all HTML files on development.

This is a really important part of the configuration since it helps you ensure your WebView is secured. See https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP.

freeze_prototype: bool

Whether Object.freeze(Object.prototype) is run as an initialization script on every webview.

This hardens the frontend against prototype pollution: once the prototype is frozen, a script cannot add or replace properties on Object.prototype and thus cannot tamper with objects it does not own, including the ones used by the Tauri API.

The script runs before any of your frontend code, on every webview, regardless of whether the content is served by the custom protocol or by a development server.

Defaults to false. Note that frontend libraries that extend built-in prototypes (polyfills, some older frameworks) stop working when this is enabled, so test your application with it on before shipping.

dangerous_disable_asset_csp_modification: DisabledCspModificationKind

Disables the Tauri-injected CSP sources.

At compile time, Tauri parses all the frontend assets and changes the Content-Security-Policy to only allow loading of your own scripts and styles by injecting nonce and hash sources. This stricts your CSP, which may introduce issues when using along with other flexing sources.

This configuration option allows both a boolean and a list of strings as value. A boolean instructs Tauri to disable the injection for all CSP injections, and a list of strings indicates the CSP directives that Tauri cannot inject.

WARNING: Only disable this if you know what you are doing and have properly configured the CSP. Your application might be vulnerable to XSS attacks without this Tauri protection.

asset_protocol: AssetProtocolConfig

Custom protocol config.

pattern: PatternKind

The application pattern, which defines how the frontend communicates with the Rust core.

• brownfield (default): the frontend talks to the core directly. Use it unless you need the extra isolation layer.
• isolation: every IPC message is routed through a secure JavaScript application you own, hosted in a sandboxed <iframe>, so it can validate or reject messages before they reach the Rust core. This protects the core from an untrusted or compromised frontend (for example one that loads third-party scripts), at the cost of an extra build step: the dir value must point at a directory containing the isolation application’s index.html.

See https://tauri.app/concept/inter-process-communication/isolation/.

capabilities: Vec<CapabilityEntry>

List of capabilities that are enabled on the application.

By default (not set or empty list), all capability files from ./capabilities/ are included, by setting values in this entry, you have fine grained control over which capabilities are included

You can either reference a capability file defined in ./capabilities/ with its identifier or inline a Capability

Example

{
  "app": {
    "security": {
      "capabilities": [
        "main-window",
        {
          "identifier": "drag-window",
          "permissions": ["core:window:allow-start-dragging"]
        }
      ]
    }
  }
}

headers: Option<HeaderConfig>

The headers, which are added to every http response from tauri to the web view This doesn’t include IPC Messages and error responses

Trait Implementations

impl Clone for SecurityConfig

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecurityConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecurityConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SecurityConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for SecurityConfig

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for SecurityConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for SecurityConfig