Tauri · Plugins and security · all subjects

http headers & webview

21 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

HTTP headers sent to WebView in Tauri.conf.json

Headers defined in the security configuration are sent with responses to the WebView. These headers do not include IPC (inter-process communication) messages or error responses. Headers are included in all responses sent via the get_response function in crates/tauri/src/protocol/tauri.rs. The feature is available since Tauri 2.1.0.

Allowed HTTP header names in Tauri configuration

Only the following header names can be configured in the security headers section: Access-Control-Allow-Credentials, Access-Control-Allow-Headers, Access-Control-Allow-Methods, Access-Control-Expose-Headers, Access-Control-Max-Age, Cross-Origin-Embedder-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, Permissions-Policy, Timing-Allow-Origin, X-Content-Type-Options, and Tauri-Custom-Header. Tauri-Custom-Header is not intended for production use.

HTTP header value types and conversion rules

Header values can be configured as: string (converted as-is), array of strings (joined with ', '), object/key-value pairs (each pair becomes 'key value', joined with '; '), or null (header is ignored). All header values are converted to strings in the actual response.

tauri.conf.json headers configuration example

Configuration example showing security headers in tauri.conf.json: Cross-Origin-Opener-Policy set to 'same-origin', Cross-Origin-Embedder-Policy set to 'require-corp', Timing-Allow-Origin as array ['https://developer.mozilla.org', 'https://example.com'], X-Content-Type-Options set to null (ignored), Access-Control-Expose-Headers set to 'Tauri-Custom-Header', and Tauri-Custom-Header as key-value object with key1 'value1' 'value2' and key2 'value3'. CSP is defined separately in the csp field, not in headers.

HTTP headers sent in helloworld example response

The helloworld example sends these HTTP headers: access-control-allow-origin: http://tauri.localhost, access-control-expose-headers: Tauri-Custom-Header, content-security-policy: default-src 'self'; connect-src ipc: http://ipc.localhost; script-src 'self' 'sha256-Wjjrs6qinmnr+tOry8x8PPwI77eGpUFR3EEGZktjJNs=', content-type: text/html, cross-origin-embedder-policy: require-corp, cross-origin-opener-policy: same-origin, tauri-custom-header: key1 'value1' 'value2'; key2 'value3', timing-allow-origin: https://developer.mozilla.org, https://example.com.

Vite headers configuration for Tauri development

For Vite-based projects (Qwik, React, Solid, Svelte, Vue), add headers to vite.config.ts under server section. Example: 'Cross-Origin-Opener-Policy': 'same-origin', 'Cross-Origin-Embedder-Policy': 'require-corp', 'Timing-Allow-Origin': 'https://developer.mozilla.org, https://example.com', 'Access-Control-Expose-Headers': 'Tauri-Custom-Header', 'Tauri-Custom-Header': "key1 'value1' 'value2'; key2 'value3'".

Angular headers configuration in angular.json

For Angular projects, add headers to angular.json under projects > [project-name] > architect > serve > options > headers. Include: Cross-Origin-Opener-Policy: 'same-origin', Cross-Origin-Embedder-Policy: 'require-corp', Timing-Allow-Origin: 'https://developer.mozilla.org, https://example.com', Access-Control-Expose-Headers: 'Tauri-Custom-Header', Tauri-Custom-Header: "key1 'value1' 'value2'; key2 'value3'".

Nuxt headers configuration in nuxt.config.ts

For Nuxt projects, add headers to nuxt.config.ts under vite > server > headers. Example: 'Cross-Origin-Opener-Policy': 'same-origin', 'Cross-Origin-Embedder-Policy': 'require-corp', 'Timing-Allow-Origin': 'https://developer.mozilla.org, https://example.com', 'Access-Control-Expose-Headers': 'Tauri-Custom-Header', 'Tauri-Custom-Header': "key1 'value1' 'value2'; key2 'value3'".

Next.js headers configuration in next.config.js

For Next.js projects (which do not use Vite), define headers in next.config.js using async headers() function returning an array of header objects. Each object has source and headers array. Headers array contains objects with key and value properties. Example: source '/*' with headers for Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy, Timing-Allow-Origin, Access-Control-Expose-Headers, and Tauri-Custom-Header.

Trunk.toml headers configuration for Yew and Leptos

For Rust projects using Yew or Leptos, add headers to Trunk.toml under [serve] section. Example: Cross-Origin-Opener-Policy = 'same-origin', Cross-Origin-Embedder-Policy = 'require-corp', Timing-Allow-Origin = 'https://developer.mozilla.org, https://example.com', Access-Control-Expose-Headers = 'Tauri-Custom-Header', Tauri-Custom-Header = "key1 'value1' 'value2'; key2 'value3'".

Cross-Origin-Opener-Policy and SharedArrayBuffer

The Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy headers should be configured to permit SharedArrayBuffer usage. Cross-Origin-Opener-Policy set to 'same-origin' and Cross-Origin-Embedder-Policy set to 'require-corp' allow this functionality.

Timing-Allow-Origin header purpose

The Timing-Allow-Origin header permits scripts loaded from listed websites to access detailed network timing data via the Resource Timing API.

CSP not defined in headers configuration

Content Security Policy (CSP) is not defined within the headers section of the security configuration. CSP is instead defined separately in the csp field of the security configuration.

WebView2 used on Windows with auto-updates

Tauri uses Microsoft Edge's WebView2 component (based on Chromium) on Windows. WebView2 supports auto-updates and all Windows versions receive relatively recent Chromium builds. WebView2 is available on Windows 7 and later, and comes preinstalled on Windows 11. On earlier Windows versions, Tauri's generated installer installs WebView2 automatically.

WebKit used on macOS, iOS, and Linux

Tauri uses WKWebView on macOS, webkit2gtk on Linux, and WebKit across all three platforms. macOS uses the system WebView which is preinstalled on macOS 10.10 (Yosemite) and later and considered a core component updated with regular OS updates.

WebKit version number format with five segments

WebKit version numbers consist of five segments plus a system version prefix: $(SYSTEM_VERSION_PREFIX)$(MAJOR_VERSION).$(MINOR_VERSION).$(TINY_VERSION).$(MICRO_VERSION).$(NANO_VERSION). The SYSTEM_VERSION_PREFIX appears only in macOS and iOS builds, not Linux. The last two segments (MICRO_VERSION and NANO_VERSION) are omissible if both are 0, so 613.2.7.0.0 becomes 613.2.7.

SYSTEM_VERSION_PREFIX mapping for macOS and iOS

The SYSTEM_VERSION_PREFIX values map to OS versions as follows: sdk=iphone* = 8, macOS 14.0 = 19, macOS 13.0 = 18, macOS 12.0 = 17, macOS 11.0 = 16, macOS 10.15 = 15, macOS 10.14 = 14, macOS 10.13 = 13, macOS 10.12 = 12, macOS 10.11 = 11.

Check macOS WebKit version via terminal

To check the WebKit version used by WKWebView on the current macOS version, use the terminal command: awk '/CFBundleVersion/{getline;gsub(/<[^>]*>/,"");print}' /System/Library/Frameworks/WebKit.framework/Resources/Info.plist

macOS WebKit and Safari version table

Mapping of macOS OS versions to WebKit versions and Safari versions includes: Sonoma 14.0 Beta with WebKit 616.1.14.11.11 and Safari 17.0; Ventura 13.4.1 with WebKit 615.2.9.11.7 and Safari 16.5.1; Ventura 13.3.1 with WebKit 615.1.26.11.23; Ventura 13.3 with WebKit 615.1.26.11.22 and Safari 16.4; Ventura 13.2.1 with WebKit 614.4.6.1.6; Ventura 13.1 with WebKit 614.3.7.1.5 and Safari 16.2; Ventura 13.0 with WebKit 614.2.9.1.12 and Safari 16.1; Monterey 12.5.1 with WebKit 613.3.9.1.16 and Safari 15.6.1; Monterey 12.5 with WebKit 613.3.9.1.5 and Safari 15.6; Monterey 12.4 with WebKit 613.2.7.1.8 and Safari 15.5; Monterey 12.3.1 with WebKit 613.1.17.1.13; Monterey 12.3 with WebKit 613.1.17.1.6 and Safari 15.4; Monterey 12.2.1 with WebKit 612.4.9.1.8; Monterey 12.2 with WebKit 612.4.9.1.5 and Safari 15.3; Monterey 12.1 with WebKit 612.3.6.1.6 and Safari 15.2; Monterey 12.0.1 with WebKit 612.2.9.1.20 and Safari 15.1; Monterey 12.0 with WebKit 612.1.29.41.4 and Safari 15.0; Big Sur 11.5.2 with WebKit 611.3.10.1.6; Big Sur 11.5 with WebKit 611.3.10.1.3 and Safari 14.1.2; Big Sur 11.4 with WebKit 611.2.7.1.4 and Safari 14.1.1; Big Sur 11.3 with WebKit 611.1.21.161.3 and Safari 14.1; Big Sur 11.2 with WebKit 610.4.3.1.4 and Safari 14.0.3; Big Sur 11.1 with WebKit 610.3.7.1.9 and Safari 14.0.2; Big Sur 11.0.1 with WebKit 610.2.11.51.8; Big Sur 11.0 with WebKit 610.2.11.1.3 and Safari 14.0.1; Catalina 10.15.7 Security Update 2022-004 with WebKit 609.4.1.1.1; Catalina 10.15.7 with WebKit 609.4.1 and Safari 13.1.3; Catalina 10.15.6 with WebKit 609.3.5.1.3 and Safari 13.1.2; Catalina 10.15.5 with WebKit 609.2.9.1.2 and Safari 13.1.1; Catalina 10.15.4 with WebKit 609.1.20.111.8 and Safari 13.1; Catalina 10.15.3 with WebKit 608.5.11 and Safari 13.0.5; Catalina 10.15.2 with WebKit 608.4.9.1.3 and Safari 13.0.4; Catalina 10.15.1 with WebKit 608.3.10.1.4 and Safari 13.0.3; Catalina 10.15 with WebKit 608.2.30.1.1 and Safari 13.0.2; Mojave 10.14.6 with WebKit 608.1.49 and Safari 13.0; Mojave 10.14.4 with WebKit 607.1.40.1.5 and Safari 12.1; Mojave 10.14.3 with WebKit 606.4.5 and Safari 12.0.3; Mojave 10.14.2 with WebKit 606.3.4 and Safari 12.0.2; Mojave 10.14.1 with WebKit 606.2.104.1.1 and Safari 12.0.1; Mojave 10.14 with WebKit 606.2.11 and Safari 12.0; High Sierra 10.13.6 with WebKit 605.3.8 and Safari 11.1.2; High Sierra 10.13.5 with WebKit 605.2.8 and Safari 11.1.1; High Sierra 10.13.4 Security Update 2018-001 with WebKit 605.1.33.1.4 and Safari 11.1; High Sierra 10.13.4 with WebKit 605.1.33.1.2 and Safari 11.1; High Sierra 10.13.3 with WebKit 604.5.6 and Safari 11.0.3; High Sierra 10.13.2 Supplementary Update with WebKit 604.4.7.1.6 and Safari 11.0.2; High Sierra 10.13.2 with WebKit 604.4.7.1.3 and Safari 11.0.2; High Sierra 10.13.1 with WebKit 604.3.5 and Safari 11.0.1; High Sierra 10.13 with WebKit 604.1.38.1.6 and Safari 11.0.

macOS WebKit not updated on unsupported OS versions

On macOS, Tauri uses the system preinstalled WebView which is considered a core component updated with regular OS updates. Unsupported macOS versions do not receive WebKit updates.

Linux WebKitGTK versions and corresponding WebKit versions

WebKitGTK versions for Linux distributions map as follows: Debian 11 (with update), Ubuntu 20.04 (with update), Ubuntu 22.04 use webkitgtk 2.36 with WebKit 614.1.6 (TP 140 / Safari equivalent 16.0); Debian 10 (with update) uses webkitgtk 2.34 with WebKit 613.1.1 (Safari equivalent 15.4); Debian 11, Ubuntu 18.04 (with update), CentOS 8 (non-stream) use webkitgtk 2.32 with WebKit 612.1.6 (Safari equivalent 15.0); Ubuntu 20.04 uses webkitgtk 2.28 with WebKit 610.1.1 (Safari equivalent 14.0); Debian 9 (with backport), Debian 10 use webkitgtk 2.24 with WebKit 608.1.6 (Safari equivalent 13.0); Ubuntu 18.04 uses webkitgtk 2.20 with WebKit 606.1.4 (Safari equivalent 12.0).

Give your agent this brain