Skip to content

Repository navigation

TAURI_CONFIG.md

Latest commit

 

History

History
54 lines (32 loc) · 3.13 KB

TAURI_CONFIG.md

File metadata and controls

54 lines (32 loc) · 3.13 KB
Raw

Tauri Configuration Notes

This document records important configuration decisions for the Tauri desktop shell.

Content Security Policy

The Tauri configuration should not leave Content Security Policy disabled. A CSP provides a browser-level defense layer against accidental script execution and other frontend injection risks. This is useful even though Mooquant is a local-first desktop application, because the frontend renders local dashboard data, logs, watchlists, strategy output, and other values that may originate outside the UI code itself.

The recommended CSP for the current application is:

{
  "security": {
    "csp": "default-src 'self'; connect-src 'self' http://127.0.0.1:8000; img-src 'self' asset: data:; script-src 'self'; style-src 'self' 'unsafe-inline'; manifest-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'"
  }
}

This policy assumes that the FastAPI backend runs locally at http://127.0.0.1:8000, which is the default development backend origin used by the frontend.

The connect-src directive allows frontend fetch and EventSource calls to the local FastAPI backend. WebSocket access is not included because Mooquant does not currently require WebSockets. If WebSockets are added later, ws://127.0.0.1:8000 may need to be added to connect-src.

The img-src directive allows local application images, Tauri asset URLs, and data URLs. This covers normal bundled images such as PNG, ICO, and SVG assets. Blob URLs are not included by default. If a chart export, screenshot feature, or library-generated image starts using blob URLs, add blob: to img-src.

The script-src 'self' directive is intentionally restrictive. Do not add 'unsafe-inline' to script-src unless there is a specific, reviewed reason. Blocking inline scripts is one of the main security benefits of enabling CSP.

The style-src 'self' 'unsafe-inline' directive is a pragmatic compromise for a React/Vite/Tailwind-style frontend where inline styles may be used by the app or its UI libraries. This is weaker than a fully strict style policy, but still substantially better than disabling CSP entirely.

The object-src 'none', base-uri 'none', and frame-ancestors 'none' directives reduce unnecessary browser features that Mooquant does not use.

When to update the CSP

Update the CSP if the frontend starts using any of the following:

Remote backend origins other than http://127.0.0.1:8000.

WebSockets, which may require adding a ws:// entry to connect-src.

Remote images, external scripts, external stylesheets, or custom web fonts.

Blob URLs for chart exports, generated images, or downloadable objects.

Iframes or embedded external content.

After changing the CSP, test the Tauri development and production builds:

npm run tauri dev
npm run tauri build

Check the dashboard streams, chart pages, live bot chart, strategy tester chart, bot logs stream, SVG icons, favicon, and any image imports from public or src/assets.

If the CSP blocks something required, the WebView developer console should report a CSP violation. Adjust the narrowest directive needed instead of broadening the entire policy.