Electron is secure by default through a policy banning the execution of content loaded over HTTP. Setting the allowRunningInsecureContent property of a webPreferences object to true will disable this policy.

Enabling the execution of insecure content is strongly discouraged.

Do not enable the allowRunningInsecureContent property.

The following example shows allowRunningInsecureContent being enabled.

This is problematic, since it allows the execution of code from an untrusted origin.

  • Electron Documentation: Security, Native Capabilities, and Your Responsibility
    •