Frontend · Electron

A Production-Ready Electron 25+ Config Stack, Hardened for Medical Desktop Apps

By 前端逗比逗 · Jul 28, 2026

Read original on juejin.cn ↗ Google Translate ↗ Alt translation

Most Electron tutorials stop at “hello world” window creation. This configuration set solves the real problems that surface when a desktop app must record audio in the background, open multiple modal windows, survive restrictive intranet policies, and lock down the renderer enough to pass a healthcare security review—all with a single, copyable webPreferences block.

Summary

The reference distills a hospital bed-rounds desktop system into a full-stack configuration blueprint for Electron 25 and above. It walks through five layers: package.json scaffolding, main-process lifecycle hooks, every BrowserWindow option, a security-hardened webPreferences block, and electron-builder packaging for Windows, macOS, and Linux. Each parameter is annotated with its default, risk level, and the specific production value used in the medical deployment.

Security is the backbone. The renderer runs with nodeIntegration off, contextIsolation and sandbox on, and all privileged operations—microphone access, file I/O, IPC—funneled through a single preload script using contextBridge. A separate temporary config is provided for Vue dev work, with explicit warnings to restore the locked-down settings before packaging.

Domain-specific adaptations fill the gaps that generic Electron docs leave open. Command-line switches disable the GPU sandbox to unblock Windows audio capture, background throttling is killed so recording never cuts out when the window loses focus, and certificate-error handlers trust internal hospital certificates. The packaging section covers NSIS installer customization, ASAR unpacking for native modules like ffmpeg, and generic-server auto-update feeds for air-gapped intranets.

Takeaways

— Set show: false on BrowserWindow and defer display until the ready-to-show event to eliminate the white flash on startup.

— Disable backgroundThrottling and append the disable-gpu-sandbox switch when the app needs uninterrupted background audio recording on Windows.

— Run nodeIntegration: false, contextIsolation: true, and sandbox: true together in production; expose every privileged API through a preload script with contextBridge.

— Use app.commandLine.appendSwitch before app.whenReady() to set Chromium flags for autoplay policy, file-access cross-origin, and certificate error bypass.

— Handle intranet self-signed certificates globally via the certificate-error event rather than per-request, and set allowRunningInsecureContent only when mixed HTTP/HTTPS content is unavoidable.

— Configure electron-builder with oneClick: false and allowToChangeInstallationDirectory: true so hospital IT staff can choose install paths during deployment.

— Unpack native binaries like ffmpeg from the ASAR archive using asarUnpack to keep audio/video dependencies functional after packaging.

— Set a persistent partition name (persist:your-app) to share cookies and localStorage across multiple windows without a custom session object.

— Override the default menu with Menu.setApplicationMenu(null) or a minimal template to remove unwanted menu items in production.

— Keep a separate, insecure webPreferences block for local Vue development and restore the locked-down config before every production build.

Conclusions

Electron’s default security posture has tightened considerably since v20—sandbox now defaults to true—but the docs still scatter the implications across multiple pages, making a single annotated config block unusually valuable.

The medical-domain constraints (background recording, modal multi-window, intranet CAs) expose failure modes that generic Electron guides never test: GPU sandboxing blocking microphone access, background throttling killing timers, and ASAR archives breaking native module loading.

Packaging for an air-gapped hospital intranet forces decisions that SaaS-oriented Electron apps skip entirely—generic-server update feeds, NSIS install-path control, and certificate-error handlers become hard requirements rather than nice-to-haves.

Concepts & terms

contextBridge

An Electron API that exposes a selective, synchronous API from the Node-capable preload script to the sandboxed renderer world, preventing the renderer from gaining direct access to Node or Electron internals.

ASAR

Electron’s archive format that bundles an app’s source code into a single file. Native modules that rely on filesystem paths (like ffmpeg) must be excluded from ASAR packing via asarUnpack.

backgroundThrottling

A Chromium behavior that deprioritizes timers and requestAnimationFrame in background windows. Must be set to false for apps that need uninterrupted audio recording or real-time processing when the window loses focus.

NSIS

Nullsoft Scriptable Install System, the default Windows installer framework electron-builder uses. Supports custom install paths, desktop shortcuts, and registry entries.

Source: juejin.cn ↗ Google Translate ↗ Backup ↗