Pre-flight checklist
Problem description
The Electron security guidelines discourage the use of the file:// protocol for serving app pages, yet the templates still employ this approach by default. This creates extra work for the developer that doesn't know about it (which makes the situation even more dramatic) because a newly created project is expected to be a safe foundation for future work. Moreover, the current situation almost certainly leads to unsafe code reaching production.
Proposed solution
Serve app pages using a custom protocol instead of the file:// protocol in all templates used by create-electron-app
Alternatives considered
Solution like "add a warning to the doc" is not even an option when it's possible prevent the problem at all with safe templates
Additional information
No response
Pre-flight checklist
Problem description
The Electron security guidelines discourage the use of the
file://protocol for serving app pages, yet the templates still employ this approach by default. This creates extra work for the developer that doesn't know about it (which makes the situation even more dramatic) because a newly created project is expected to be a safe foundation for future work. Moreover, the current situation almost certainly leads to unsafe code reaching production.Proposed solution
Serve app pages using a custom protocol instead of the
file://protocol in all templates used bycreate-electron-appAlternatives considered
Solution like "add a warning to the doc" is not even an option when it's possible prevent the problem at all with safe templates
Additional information
No response