Open
Conversation
- Add explicit sandbox: true to BrowserWindow webPreferences - Replace executeJavaScript with IPC for custom port configuration - Add Helmet.js security headers middleware to Express server - Add Window type declarations for Electron IPC interfaces - Create appInitialization utility for secure IPC-based config - Fix webpack cssnano build configuration
- Add node-forge for self-signed TLS certificate generation - Create tlsHelper.ts for runtime certificate generation - Create serverSecure.ts with HTTPS server, token auth, and rate limiting - Add IPC handlers for auth token, certificate, and fingerprint - Create secureFetch utility for authenticated API calls - Update API constants to use HTTPS/WSS in Electron mode - Update service files to use secureFetch - Update tests to work with new security layer Security features: - Self-signed TLS certificates generated at runtime - 32-byte random auth token per session - Token validation middleware on all /api/* routes - Rate limiting: 100 requests/minute per client - WebSocket authentication via query parameter
- Add encrypted credential storage using Electron's safeStorage API - Create credentialsHandler.ts with store/get/delete/list functions - Add IPC handlers for credential operations in electron.ts - Create credentialStorage.ts utility for connection string encryption - Update connection string sagas to use encrypted storage - Implement automatic migration from localStorage to encrypted storage - Add browser-mode fallback to localStorage when Electron unavailable - Update tests for new async credential storage patterns Build: PASSED Tests: 710/710 passing
- Add CSP headers via Electron session.webRequest.onHeadersReceived - Configure strict CSP directives: * default-src 'self' * script-src allows self and unsafe-inline/eval for dev/Fluent UI * connect-src whitelists Azure domains and localhost TLS server * frame-ancestors 'none' prevents clickjacking * form-action 'self' restricts form submissions - Import session from electron module Build: PASSED Tests: 710/710 passing
- Add securityEnabled parameter to ServerBase (default: true) - serverLocal.ts: Disable security for local dev (HTTP, no auth, CORS enabled) - serverElectron.ts: Enable security for production (HTTPS, TLS, auth tokens) - Fix apiConstants.ts to correctly detect Electron mode for HTTPS - Change appConfig.dev.json hostMode from 'debug' to 'browser' - Add defensive null check for certificate fingerprint in electron.ts Local dev now runs on http://127.0.0.1:8082 without TLS/auth overhead. Electron production runs on https://127.0.0.1:8081 with full security.
- Add request-filtering-agent library for IP-level SSRF protection - Create urlValidator.ts with strict hostname validation (*.azure-devices.net only) - Add header sanitization with allowlist (blocks Host, Authorization, X-Forwarded-*) - Add path and query string validation - Block HTTP redirects with redirect: 'error' - Use dynamic import for ESM compatibility with Electron SSRF protections: - Blocks private IPs (10.x, 172.16-31.x, 192.168.x) - Blocks loopback (127.x.x.x, ::1, localhost) - Blocks link-local (169.254.x.x, fe80::) - Blocks cloud IMDS (169.254.169.254) - Blocks DNS rebinding attacks - Validates hostname is exactly *.azure-devices.net
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.
Thank you for contributing to the Azure IoT Explorer!
This checklist is used to make sure that common guidelines for a pull request are followed.
General Guidelines
npm run testcommand)