github/electron
1
1
Fork 0
mirror of https://github.com/electron/electron.git synced 2026-04-10 03:01:51 -04:00
Code Issues Packages Projects Releases Wiki Activity

docs: security.md mark 'Enable process sandboxing' as active by defau… (#43247)

Browse Source 
* docs: security.md mark 'Enable process sandboxing' as active by default since electron 20

* Adjusted according to feedback

* Updated according to feedback - adjusted sandbox.md

* formatting

* Fixed broken markup

* Implemented docs linting suggestions

* docs: docs/tutorial/sandbox.md - fixed typo

Co-authored-by: Erick Zhao <erick@hotmail.ca>

* docs: web-preferences.md - sandbox: mention default value and relation to nodeIntegration

---------

Co-authored-by: Erick Zhao <erick@hotmail.ca>
This commit is contained in:
Teaveloper
2025-10-23 22:11:55 +02:00
committed by GitHub
parent 00e01e0e82
commit fbfd7c7126
3 changed files with 30 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
docs/tutorial/security.md
View File

@@ -244,6 +244,10 @@ to enable this behavior.
Even when `nodeIntegration: false` is used, to truly enforce strong isolation
and prevent the use of Node primitives `contextIsolation` **must** also be used.
Beware that _disabling context isolation_ for a renderer process by setting
`nodeIntegration: true` _also disables process sandboxing_ for that process.
See section below.
:::info
For more information on what `contextIsolation` is and how to enable it please
see our dedicated [Context Isolation](context-isolation.md) document.
@@ -251,6 +255,16 @@ see our dedicated [Context Isolation](context-isolation.md) document.
### 4. Enable process sandboxing
:::info
This recommendation is the default behavior in Electron since 20.0.0.
Additionally, process sandboxing can be enforced for all renderer processes
application wide: [Enabling the sandbox globally](sandbox.md#enabling-the-sandbox-globally)
_Disabling context isolation_ (see above) _also disables process sandboxing_,
regardless of the default, `sandbox: false` or globally enabled sandboxing!
:::
[Sandboxing](https://chromium.googlesource.com/chromium/src/+/HEAD/docs/design/sandbox.md)
is a Chromium feature that uses the operating system to
significantly limit what renderer processes have access to. You should enable