tauri-plugin-prevent-default

tauri-plugin-prevent-default is a Rust crate that stops Tauri webviews from responding to the default browser-style keyboard shortcuts and pointer events that leak through Chromium/WebKit-based webviews, such as F3 for find, Ctrl+J for downloads, Ctrl+Shift+I for DevTools, F5/Ctrl+R for reload, and right-click context menus. It works by injecting a JavaScript initialization script into the webview that intercepts and cancels the matching key and pointer events before the OS-level webview handles them, with an optional Windows-specific path that uses WebView2 COM APIs to disable browser accelerator keys, autofill, and script dialogs at a lower level.

Developers configure which shortcuts to block via a Flags bitflag set passed to the plugin Builder, or register fully custom keyboard and pointer shortcuts through the same builder API. This lets a Tauri app present itself as a native desktop application rather than an embedded browser window, while still allowing developers to keep a subset of shortcuts (like DevTools) enabled during development via the built-in debug() helper.

What You Get

• A Flags bitflag API to select which shortcut categories to disable (find, caret browsing, DevTools, downloads, focus move, reload, view source, open, print, context menu)
• A Builder for registering fully custom keyboard shortcuts with arbitrary modifier combinations, or custom pointer-event shortcuts
• A debug() preset that keeps DevTools, reload, and context menu enabled while cfg!(debug_assertions) is true, so shortcuts stay usable during development
• Manual script-injection mode (build_with_manual_injection) for apps that need to control exactly when the prevention script runs
• Windows-specific PlatformOptions (behind the platform-windows feature) that use WebView2 COM APIs to disable browser accelerator keys, autofill, and default script dialogs at the OS level
• An optional check_origin guard so the prevention script only runs when the webview’s location matches an expected origin

Common Use Cases

• Preventing end users from accidentally opening browser DevTools (Ctrl+Shift+I) in a shipped desktop app
• Blocking Ctrl+P/print, Ctrl+J/downloads, and Ctrl+F/find so a Tauri app doesn’t expose browser chrome behavior
• Disabling the right-click context menu so a desktop app doesn’t show ‘Reload’, ‘Back’, or ‘Inspect’ options meant for web pages
• Keeping DevTools and reload shortcuts active only in dev builds via the debug() preset, while locking them down in release builds
• Hardening kiosk-style or embedded Tauri apps on Windows using PlatformOptions to disable WebView2-level autofill and accelerator keys

Under The Hood

Architecture The crate is a single-purpose Tauri plugin built around a Builder that composes configuration (Flags, custom Shortcut trait objects, an optional check_origin, and Windows PlatformOptions) into a TauriPlugin via Tauri’s own PluginBuilder. create_script() walks the collected Shortcut trait objects (KeyboardShortcut and PointerShortcut, unified through a small ShortcutKind enum in src/shortcut/mod.rs) and renders them into a JS snippet that gets spliced into a template asset (assets/script.js) via include_str!, then injected as the webview’s init script through js_init_script(). A parallel platform/windows.rs module, gated behind the platform-windows feature and cfg(windows), hooks on_webview_ready to apply WebView2 COM-level settings. The design is a straightforward single-responsibility pipeline (collect config -> render script -> attach to plugin), so changing the Shortcut trait’s shape would ripple through both KeyboardShortcut/PointerShortcut implementations and the script-rendering loop in create_script().

Tech Stack Rust edition 2021 (MSRV 1.77.2) built against tauri v2 with default features disabled. Core dependencies are bitflags 2.13 for the Flags type, strum 0.28 (derive) for enum Display/EnumIs implementations, thiserror 2 plus serde for a typed, serializable Error enum, and itertools 0.15. Windows-only optional dependencies webview2-com and windows back the platform-windows feature. There is no runtime, database, or web framework beyond Tauri itself and the small embedded JS asset; cargo clippy with pedantic lints denied (clone_on_ref_ptr, needless_borrow, useless_conversion, etc.) is the only enforced static-analysis gate.

Code Quality Only four #[test] functions exist, both in src/shortcut/mod.rs, covering ShortcutKind discrimination and ModifierKey ordering — there is no test coverage for script generation, flag-combination behavior, or the Windows platform path. The CI workflow (test-pr.yml) runs cargo +nightly clippy only; it does not run cargo test, so even the existing four tests aren’t verified on every PR. Error handling is typed via a #[non_exhaustive] thiserror::Error enum wrapping strum::ParseError and tauri::Error. Naming is idiomatic and consistent, and pedantic clippy lints are enforced, but the thin, CI-unverified test suite limits confidence in regressions.

What Makes It Unique The plugin isn’t a novel technique so much as a tightly scoped fix for a well-known Tauri pain point: Chromium/WebKit-based webviews leak browser-chrome keyboard shortcuts and context menus into what’s meant to be a native-feeling desktop app. Its defense-in-depth combination of a JS-injected interception script for cross-platform coverage plus an optional WebView2 COM API layer for deeper OS-level hardening on Windows is a solid, pragmatic engineering choice rather than a groundbreaking one; comparable prevent-default plugins exist elsewhere in the Tauri ecosystem for adjacent concerns.