How to set tauri to not allowed to load local resource？

In Tauri applications, ensuring security is a critical aspect, which includes restricting the loading of local resources. By default, Tauri's security policies are strict, and you can achieve this by appropriately configuring the settings in the configuration file.

Steps:

1. Configure the tauri.conf.json file

   In the root directory of your Tauri project, there is a configuration file named tauri.conf.json that is responsible for configuring various behaviors and security policies of the application.

2. Set Content Security Policy (CSP)

   In the tauri.conf.json file, locate the security section. CSP is a security standard that defines which resources a page can load. By setting CSP, you can prevent loading resources from the local file system. For example:

   json
   "security": {
     "csp": "default-src 'self';"
   }

   Here, 'self' specifies that only resources from the application's server (typically a local server) are permitted. It excludes any local files using the file:// protocol, thereby preventing local resources from being loaded.

Example:

Suppose you are developing a Tauri application where you do not want the app to load images or other media files from the local file system. This can be achieved by setting CSP. This ensures that even if a part of the application (e.g., user-provided content) attempts to reference local resources, they will not be loaded, thereby enhancing the application's security.

Conclusion:

By correctly configuring CSP in tauri.conf.json, you can effectively restrict Tauri applications from loading local resources, ensuring the application's security and stability. This is crucial for preventing potential cross-site scripting (XSS) attacks and data leaks.