Capabilities
The declarative Tauri ACL protecting the desktop shell.
Tauri's security boundary is a declarative capabilities ACL, not a preload
script. A webview can use only the APIs granted to its window; anything absent
is rejected by the Rust core before application code runs. The starter has one
file, src-tauri/capabilities/default.json, assigned only to the main window.
What is granted
The file starts with core:default, then grants individual window operations
(minimize, maximize, drag, resize, close, show/hide, focus, inspect maximize),
webview zoom, typed event listening, and these feature bundles:
| Feature | Permission family |
|---|---|
| Deep links and restored bounds | deep-link:default, window-state:default |
| Preferences, backup and files | store:default, dialog:default, fs:default plus three explicit file reads/writes |
| Launch and OS integrations | autostart:default, notification:default, global-shortcut register/unregister, os:default, process:default |
| Support diagnostics | log:default, scoped opener path access |
| External links | opener:allow-open-url scoped to https://** and mailto:* |
The rule is explicit in the file: never use a wildcard grant. The opener is
the key example: it cannot open file:, javascript:, or arbitrary custom
protocols.
Extend safely
- Find the narrowest permission in
src-tauri/gen/schemas/or the plugin docs. - Add a scope for paths, URLs, or event names whenever the permission supports it.
- Put it in the capability for the specific window that needs it.
- Run
pnpm tauri build --no-bundle; generated-schema validation reports an unknown or malformed permission.
An ACL denial is a signal to reduce the requested surface, not an invitation to
grant an entire plugin. Custom Rust commands are deliberately kept few and
registered in collect_commands![]; secure storage additionally restricts
credential names with a Rust enum.
The ACL is not the only layer. The strict CSP prevents the webview from leaving
the app, and src/lib/tauri/external-url.ts validates https: / mailto:
before calling the Rust opener command. See Architecture
and Windows, Menus & Tray.