dk.simongray.wary-fetch.electron — dk.simongray/wary-fetch 0.15.0

A :send for the page of an Electron app, which sends each request through the main process, where Node sends it and CORS doesn't stop it.

The main process answers with handler, and the page sends with sender over Electron's IPC, which the preload script exposes to the page:

;; main process
(.handle ipcMain "wary-fetch" (electron/handler))

;; preload script
(.exposeInMainWorld contextBridge "waryFetch"
                    #js {:send #(.invoke ipcRenderer "wary-fetch" %)})

;; page
(def send (electron/sender (.. js/window -waryFetch -send)))

The main process applies its own limits, so a page can't reach what the handler doesn't allow, e.g. the app's own network. A request and its response cross the IPC as plain data without functions, so a page's :sink or :allow-pred stays in the page.

handler cljs

(handler)

(handler {:keys [send allow-pred max-bytes timeout-seconds]
          :or {send http/send!
               allow-pred url/public?
               max-bytes (* 100 1024 1024)
               timeout-seconds 30}
          :as opts})

A function to pass to ipcMain.handle in the main process, which sends each request of a page with the :send and within the limits of opts, and returns a promise of the response as plain data.

The opts set what the main process allows:

• :send, the function that sends, http/send! by default
• :allow-pred, the URLs that a page may reach, url/public? by default, whatever a page asks
• :max-bytes and :timeout-seconds, the most that a page may ask for, by default those of send!

sender cljs

(sender invoke)

A function to pass as :send in the page, which sends each request through the main process with invoke.

The invoke function passes the plain data of a request to the main process's handler and returns a promise of its answer, e.g. ipcRenderer.invoke with the name of the channel. The keys of a request are those of send!, except :sink, :allow-pred and :signal, which the main process doesn't get. The sender checks the :signal before the request crosses. Hidden headers and bodies cross as text, as they go to a server. The main process follows the redirects, so the :prepare-fn of the request runs in the page, on the first hop alone.