skills.rest
dt418
dt418COMMUNITY
Explore all skills by this author →
GitHub

configuring-tauri-csp

Configures Content Security Policy directives in Tauri v2 applications to restrict resource loading.

Updated Jun 7, 2026
Search Tags:#csp#tauri#tauri.conf.json#content security policy#xss prevention#webview hardening#desktop security
One-click install
npx skills add https://github.com/dt418/better-shot-x --skill configuring-tauri-csp-dt418
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: configuring-tauri-csp
Source: https://github.com/dt418/better-shot-x/tree/main/.agents/skills/configuring-tauri-csp
Command: npx skills add https://github.com/dt418/better-shot-x --skill configuring-tauri-csp-dt418

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Tauri v2 applications ship without a Content Security Policy by default, leaving the WebView exposed to XSS attacks and unauthorized resource loading. This Skill guides developers through writing correct, restrictive CSP configurations in tauri.conf.json. ## Core Features & Use Cases - Directive-by-Directive Guidance: Explains default-src, script-src, style-src, connect-src, img-src, font-src, and other directives with Tauri-specific values like ipc:, asset:, and customprotocol:. - Framework-Specific Templates: Provides ready configurations for React/Vue/Svelte apps and Rust/WASM frameworks (Leptos, Yew, Dioxus) requiring 'wasm-unsafe-eval'. - Troubleshooting Coverage: Diagnoses common CSP violations such as blocked scripts, broken WebAssembly, non-working inline styles, and IPC connection failures. - Use Case: A developer hardening a Tauri desktop app before release uses this Skill to write a restrictive CSP, enable freezePrototype, and resolve console CSP violation errors. ## Quick Start Ask the assistant to generate a secure CSP configuration for your Tauri v2 app in tauri.conf.json.

Frequently Asked Questions about configuring-tauri-csp

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure CSP in a Tauri v2 application?▼

Add a csp object under the security section of tauri.conf.json, for example setting default-src to 'self'. Tauri applies no CSP by default, so protection only activates once you explicitly configure directives.

What CSP directives does a Tauri app need?▼

A typical Tauri CSP sets default-src to 'self' customprotocol: asset:, connect-src to ipc: http://ipc.localhost, and restrictive script-src, style-src, and img-src values. Also set object-src to 'none' to block plugin content.

Why is WebAssembly not loading in my Tauri app?▼

WASM fails when script-src lacks the 'wasm-unsafe-eval' source, which Rust-based frameworks like Leptos, Yew, and Dioxus require. Add it as "script-src": "'self' 'wasm-unsafe-eval'" in your CSP configuration.

Why are inline styles blocked by CSP in Tauri?▼

CSP blocks inline styles unless style-src includes 'unsafe-inline', which CSS-in-JS libraries often require. Use "style-src": "'self' 'unsafe-inline'", noting this slightly reduces security compared to 'self' alone.

Does Tauri apply a Content Security Policy by default?▼

No, Tauri does not enforce any CSP when the csp field is null or omitted from tauri.conf.json. You must explicitly define directives under the security section for protection to activate.

Should I load scripts from a CDN in a Tauri app?▼

No, loading scripts from CDNs introduces an attack vector and is discouraged in production Tauri apps. Bundle all dependencies locally and keep script-src restricted to 'self'.

Related Skills

Explore More Software Engineering Skills→
dchukdchuk
30

integrating-tauri-js-frontends

Configure JavaScript frontend frameworks for Tauri v2 static output.

Community
Advanced
FlukeSupakornFlukeSupakorn
1

understanding-tauri-lifecycle-security

Identify and mitigate lifecycle security threats in Tauri applications.

Community
Advanced
OpenAEC-FoundationOpenAEC-Foundation
4

tauri-impl-security

Configure CSP, permissions, and isolation patterns for Tauri 2 apps.

Official
Advanced
davila7davila7
30.5k

electron-development

Build secure Electron desktop apps with IPC, packaging, code signing, and auto-update.

Community
Advanced