Using Preload Scripts

This is part 3 of the Electron tutorial.

In this part of the tutorial, you will learn what a preload script is and how to use one to securely expose privileged APIs into the renderer process. You will also learn how to communicate between main and renderer processes with Electron’s inter-process communication (IPC) modules.

Electron’s main process is a Node.js environment that has full operating system access. On top of Electron modules, you can also access , as well as any packages installed via npm. On the other hand, renderer processes run web pages and do not run Node.js by default for security reasons.

To bridge Electron’s different process types together, we will need to use a special script called a preload.

A BrowserWindow’s preload script runs in a context that has access to both the HTML DOM and a limited subset of Node.js and Electron APIs.

Preload script sandboxing

From Electron 20 onwards, preload scripts are sandboxed by default and no longer have access to a full Node.js environment. Practically, this means that you have a polyfilled function that only has access to a limited set of APIs.

For more information, check out the guide.

Preload scripts are injected before a web page loads in the renderer, similar to a Chrome extension’s content scripts. To add features to your renderer that require privileged access, you can define objects through the contextBridge API.

To demonstrate this concept, you will create a preload script that exposes your app’s versions of Chrome, Node, and Electron into the renderer.

Add a new preload.js script that exposes selected properties of Electron’s process.versions object to the renderer process in a versions global variable.

preload.js

main.js

const { app, BrowserWindow } = require('electron')
const path = require('path')
const createWindow = () => {
  const win = new BrowserWindow({
    width: 800,
    height: 600,
    webPreferences: {
      preload: path.join(__dirname, 'preload.js'),
    },
  })
  win.loadFile('index.html')
}
app.whenReady().then(() => {
  createWindow()
})

info

There are two Node.js concepts that are used here:

The API joins multiple path segments together, creating a combined path string that works across all platforms.

At this point, the renderer has access to the versions global, so let’s display that information in the window. This variable can be accessed via window.versions or simply versions. Create a renderer.js script that uses the document.getElementById DOM API to replace the displayed text for the HTML element with info as its id property.

renderer.js

const information = document.getElementById('info')
information.innerText = `This app is using Chrome (v${versions.chrome()}), Node.js (v${versions.node()}), and Electron (v${versions.electron()})`

Then, modify your index.html by adding a new element with info as its id property, and attach your script:

index.html

After following the above steps, your app should look something like this:

And the code should look like this:

Open in Fiddle

main.js
preload.js
index.html
renderer.js

const { app, BrowserWindow } = require('electron');
const path = require('path');
const createWindow = () => {
  const win = new BrowserWindow({
    width: 800,
    height: 600,
    webPreferences: {
      preload: path.join(__dirname, 'preload.js'),
    },
  });
  win.loadFile('index.html');
};
app.whenReady().then(() => {
  createWindow();
  app.on('activate', () => {
    if (BrowserWindow.getAllWindows().length === 0) {
      createWindow();
    }
});
app.on('window-all-closed', () => {
  if (process.platform !== 'darwin') {
    app.quit();
  }
});

const { contextBridge } = require('electron');
contextBridge.exposeInMainWorld('versions', {
  chrome: () => process.versions.chrome,
  electron: () => process.versions.electron,
});

const information = document.getElementById('info');
information.innerText = `This app is using Chrome (v${versions.chrome()}), Node.js (v${versions.node()}), and Electron (v${versions.electron()})`;

As we have mentioned above, Electron’s main and renderer process have distinct responsibilities and are not interchangeable. This means it is not possible to access the Node.js APIs directly from the renderer process, nor the HTML Document Object Model (DOM) from the main process.

To illustrate, we will add a global function to the renderer called ping() that will return a string from the main process.

First, set up the invoke call in your preload script:

preload.js

const { contextBridge, ipcRenderer } = require('electron')
contextBridge.exposeInMainWorld('versions', {
  node: () => process.versions.node,
  chrome: () => process.versions.chrome,
  electron: () => process.versions.electron,
  ping: () => ipcRenderer.invoke('ping'),
  // we can also expose variables, not just functions
})

IPC security

Notice how we wrap the ipcRenderer.invoke('ping') call in a helper function rather than expose the ipcRenderer module directly via context bridge. You never want to directly expose the entire ipcRenderer module via preload. This would give your renderer the ability to send arbitrary IPC messages to the main process, which becomes a powerful attack vector for malicious code.

Then, set up your handle listener in the main process. We do this before loading the HTML file so that the handler is guaranteed to be ready before you send out the invoke call from the renderer.

main.js

Once you have the sender and receiver set up, you can now send messages from the renderer to the main process through the 'ping' channel you just defined.

renderer.js

const func = async () => {
  const response = await window.versions.ping()
  console.log(response) // prints out 'pong'
}
func()

info

For more in-depth explanations on using the ipcRenderer and modules, check out the full Inter-Process Communication guide.

A preload script contains code that runs before your web page is loaded into the browser window. It has access to both DOM APIs and Node.js environment, and is often used to expose privileged APIs to the renderer via the contextBridge API.

In the next part of the tutorial, we will be showing you resources on adding more functionality to your app, then teaching you distributing your app to users.