require module inside preload script in electron

Question

I'm building an app with electron react and MySQL, I'm stuck in preload script where i want to make my db instance available in render-er process, i got the following error Error: module not found: ./config/db in console. this happening when i try to require a module inside preload script.

const { app, BrowserWindow } = require("electron");
const path = require("path");
const isDev = require("electron-is-dev");
const dotenv = require("dotenv");

//load .env
dotenv.config();

function createWindow() {
  // Create the browser window.
  const mainWindow = new BrowserWindow({
    title: "Electron",
    minWidth: 800,
    minHeight: 600,
    webPreferences: {
      preload: path.join(__dirname, "preload.js"),
      devTools: isDev,
    },
  });

  //get url dependig on envirement (dev/prod)
  const url = isDev
    ? `http://localhost:${process.env.PORT}/`
    : `file://${path.join(__dirname, "../../dist/react/index.html")}`;

  // load the url
  mainWindow.loadURL(url);

  // Open the DevTools.
  isDev && mainWindow.webContents.openDevTools();
}

// This method will be called when Electron has finished
// initialization and is ready to create browser windows.
// Some APIs can only be used after this event occurs.
app.whenReady().then(() => {
  createWindow();

  app.on("activate", function () {
    // On macOS it's common to re-create a window in the app when the
    // dock icon is clicked and there are no other windows open.
    if (BrowserWindow.getAllWindows().length === 0) createWindow();
  });
});

// Quit when all windows are closed, except on macOS. There, it's common
// for applications and their menu bar to stay active until the user quits
// explicitly with Cmd + Q.
app.on("window-all-closed", function () {
  if (process.platform !== "darwin") app.quit();
});

// In this file you can include the rest of your app's specific main process
// code. You can also put them in separate files and require them here.

require("./handlers");

preload

const { contextBridge, ipcRenderer } = require("electron");
const { db } = require("./config/db");

contextBridge.exposeInMainWorld("mainApi", {
  db,
});

Answer 1

Since Electron v20.0.0, the sandbox parameter defaults to true (according to the list of Breaking Changes)

One of the side effects of the sandbox attribute is that it can only require a few things:

A require function similar to Node's require module is exposed, but can only import a subset of Electron and Node's built-in modules:

electron (only renderer process modules)
events
timers
url

To disable sandboxing, add sandbox: false to your webPreferences on window creation:

  // ...

  // Create the browser window.
  const mainWindow = new BrowserWindow({
    title: "Electron",
    minWidth: 800,
    minHeight: 600,
    webPreferences: {
      preload: path.join(__dirname, "preload.js"),
      devTools: isDev,
      sandbox: false, // fixes require() in preloader
    },
  });

  // ...

But be aware:

Electron intentionally enabled sandboxing by default to help prevent major vulnerabilities.

Do not disable sandboxing unless you know what you're doing. Only do so if sandboxing must be disabled in order to work, but absolutely never disable it if your preloader will ever run untrusted code. If untrusted code is somehow executed in your preloaded environment, it can (and almost definitely will) lead to exploitation.