macOS High Sierra WebKit versions
macOS High Sierra includes: 10.13.6 with WebKit 605.3.8 (Safari 11.1.2); 10.13.5 with WebKit 605.2.8 (Safari 11.1.1); 10.13.4 Security Update 2018-001 with WebKit 605.1.33.1.4 (Safari 11.1); 10.13.4 with WebKit 605.1.33.1.2 (Safari 11.1); 10.13.3 with WebKit 604.5.6 (Safari 11.0.3); 10.13.2 Supplemental Update with WebKit 604.4.7.1.6 (Safari 11.0.2); 10.13.2 with WebKit 604.4.7.1.3 (Safari 11.0.2); 10.13.1 with WebKit 604.3.5 (Safari 11.0.1); 10.13 with WebKit 604.1.38.1.6 (Safari 11.0).
WebView2 on Windows based on Chromium
Tauri uses WebView2 on Windows, which is based on Microsoft Edge and therefore Chromium. WebView2 can update itself, guaranteeing a relatively recent Chromium build on all Windows targets.
WebView2 Windows version support
WebView2 is supported on Windows 7 and newer and comes preinstalled on Windows 11. On versions older than Windows 11, the installer generated by Tauri ensures WebView2 is installed on the system.
Android WebView based on Chromium
Tauri uses the system Android WebView, which is based on Chromium. Tauri does not bundle a WebView with the app, so the runtime version depends on the device's currently selected WebView provider.
Android WebView is updatable system component
On most production Android devices, WebView is an updatable system component. Some Android images can use a different preinstalled provider or allow switching providers in developer settings, so web platform support is tied to that provider's Chromium/WebView version.
WebKit on macOS, iOS, and Linux
Tauri uses WebKit on macOS through WKWebView and on Linux through webkit2gtk.
WebKit SYSTEM_VERSION_PREFIX mapping for macOS
The SYSTEM_VERSION_PREFIX values for macOS and iOS are: sdk=iphone* maps to 8; macOS 14.0 maps to 19; macOS 13.0 maps to 18; macOS 12.0 maps to 17; macOS 11.0 maps to 16; macOS 10.15 maps to 15; macOS 10.14 maps to 14; macOS 10.13 maps to 13; macOS 10.12 maps to 12; macOS 10.11 maps to 11.
macOS Sonoma WebKit version
macOS Sonoma 14.0 (Beta) includes WebKit version 616.1.14.11.11, corresponding to Safari 17.0.
macOS Ventura WebKit versions
macOS Ventura includes: 13.4.1 with WebKit 615.2.9.11.7 (Safari 16.5.1); 13.3.1 with WebKit 615.1.26.11.23; 13.3 with WebKit 615.1.26.11.22 (Safari 16.4); 13.2.1 with WebKit 614.4.6.1.6; 13.2 with Safari 16.3 (WebKit version unknown); 13.1 with WebKit 614.3.7.1.5 (Safari 16.2); 13.0.1 (WebKit version unknown); 13.0 with WebKit 614.2.9.1.12 (Safari 16.1).
macOS Monterey WebKit versions
macOS Monterey includes: 12.6 (WebKit version unknown); 12.5.1 with WebKit 613.3.9.1.16 (Safari 15.6.1); 12.5 with WebKit 613.3.9.1.5 (Safari 15.6); 12.4 with WebKit 613.2.7.1.8 (Safari 15.5); 12.3.1 with WebKit 613.1.17.1.13; 12.3 with WebKit 613.1.17.1.6 (Safari 15.4); 12.2.1 with WebKit 612.4.9.1.8; 12.2 with WebKit 612.4.9.1.5 (Safari 15.3); 12.1.1 (WebKit version unknown); 12.1 with WebKit 612.3.6.1.6 (Safari 15.2); 12.0.1 with WebKit 612.2.9.1.20 (Safari 15.1); 12.0 with WebKit 612.1.29.41.4 (Safari 15.0).
macOS Big Sur WebKit versions
macOS Big Sur includes: 11.6.7 through 11.6 (WebKit versions unknown); 11.5.2 with WebKit 611.3.10.1.6; 11.5.1 (WebKit version unknown); 11.5 with WebKit 611.3.10.1.3 (Safari 14.1.2); 11.4 with WebKit 611.2.7.1.4 (Safari 14.1.1); 11.3.1 (WebKit version unknown); 11.3 with WebKit 611.1.21.161.3 (Safari 14.1); 11.2.3 with WebKit 610.4.3.1.7; 11.2.2 and 11.2.1 (WebKit versions unknown); 11.2 with WebKit 610.4.3.1.4 (Safari 14.0.3); 11.1 with WebKit 610.3.7.1.9 (Safari 14.0.2); 11.0.1 with WebKit 610.2.11.51.8; 11.0 with WebKit 610.2.11.1.3 (Safari 14.0.1).
macOS Catalina WebKit versions
macOS Catalina includes: 10.15.7 Security Update 2022-004 with WebKit 609.4.1.1.1; 10.15.7 with WebKit 609.4.1 (Safari 13.1.3); 10.15.6 with WebKit 609.3.5.1.3 (Safari 13.1.2); 10.15.5 with WebKit 609.2.9.1.2 (Safari 13.1.1); 10.15.4 with WebKit 609.1.20.111.8 (Safari 13.1); 10.15.3 with WebKit 608.5.11 (Safari 13.0.5); 10.15.2 with WebKit 608.4.9.1.3 (Safari 13.0.4); 10.15.1 with WebKit 608.3.10.1.4 (Safari 13.0.3); 10.15 with WebKit 608.2.30.1.1 (Safari 13.0.2).
macOS Mojave WebKit versions
macOS Mojave includes: 10.14.6 with WebKit 608.1.49 (Safari 13.0); 10.14.4 with WebKit 607.1.40.1.5 (Safari 12.1); 10.14.3 with WebKit 606.4.5 (Safari 12.0.3); 10.14.2 with WebKit 606.3.4 (Safari 12.0.2); 10.14.1 with WebKit 606.2.104.1.1 (Safari 12.0.1); 10.14 with WebKit 606.2.11 (Safari 12.0).
Example CSP configuration
An example CSP configuration from the Tauri api example is:
```json
"csp": {
"default-src": "'self' customprotocol: asset:",
"connect-src": "ipc: http://ipc.localhost",
"font-src": ["https://fonts.gstatic.com"],
"img-src": "'self' asset: http://asset.localhost blob: data:",
"style-src": "'unsafe-inline' 'self' https://fonts.googleapis.com"
}
```
Every application developer needs to tailor this to their own application needs.
CSP protection only enabled when configured
The Content Security Policy (CSP) protection in Tauri is only enabled if set on the Tauri configuration file. It is not enabled by default.
CSP should be as restricted as possible
The CSP should be made as restricted as possible, only allowing the webview to load assets from hosts you trust, and preferably own.
Tauri automatically appends nonces and hashes to CSP at compile time
At compile time, Tauri appends its nonces and hashes to the relevant CSP attributes automatically to bundled code and assets, so developers only need to worry about what is unique to their application.
Avoid remote content in CSP configuration
Avoid loading remote content such as scripts served over a CDN as they introduce an attack vector. In general any untrusted file can introduce new and subtle attack vectors.
Include wasm-unsafe-eval for WebAssembly applications
When using Rust to develop your frontend, or if your frontend otherwise uses WebAssembly, remember to include 'wasm-unsafe-eval' as a script-src in the CSP configuration.
CSP prevents cross-site-scripting (XSS) vulnerabilities
Tauri's Content Security Policy (CSP) can be used to reduce or prevent the impact of common web-based vulnerabilities like cross-site-scripting (XSS).
Local scripts are hashed in Tauri CSP
Local scripts are hashed, while styles and external scripts are referenced using a cryptographic nonce, which prevents unallowed content from being loaded.