Context Isolation Configuration and Security Considerations

[vijaythecoder]

I've been working on integrating additional APIs into NativePHP and noticed that contextIsolation is set to false by default in the window configuration.

Current Configuration

// electron-plugin/src/server/api/window.ts
const defaultWebPreferences = {
    backgroundThrottling: false,
    spellcheck: false,
    preload: preloadPath,
    sandbox: false,
    contextIsolation: false,
    nodeIntegration: true,
}; 

Even if I try to pass this via NativeAppServiceProvider using webPreferences([]) its overwritten by defaultWebPreferences here

    webPreferences: {
        ...webPreferences,
        ...defaultWebPreferences
    },

Question
What was the reasoning behind setting contextIsolation: false by default? I assume this was a deliberate choice to simplify the API surface for PHP developers.

Context
I'm asking because Electron's default since v12 is contextIsolation: true, and when trying to add new APIs using contextBridge, I was not able to expose them properly with the current configuration.

Proposed Solution

// resources/nativephp-electron/resources/js/electron-plugin/src/preload/index.mts
// Current 
window.Native = Native;
window.remote = remote;

// Proposed (secure)
import { contextBridge } from 'electron';
contextBridge.exposeInMainWorld('Native', Native);
contextBridge.exposeInMainWorld('remote', remote);

// resources/js/electron-plugin/src/server/api/window.ts
    webPreferences: {
        ...defaultWebPreferences,
        ...webPreferences
    },