Repository: electron
Issue: Best Practices/Security - Use examples that work out-of-the-box
Labels: documentation :notebook:

Hi there! Thank you for the good documentation - setting Electron up worked like a charm! 

I did run into some problems with implementing the security guide, though. Those problems could be mittigated with some additional comments/context in the examples.

Specifically:

### 5. Handle session permission requests from remote content

Original example given: 

```js
const { session } = require('electron')
const { URL } = require('url')

session
  .fromPartition('some-partition')
  .setPermissionRequestHandler((webContents, permission, callback) => {
    const parsedUrl = new URL(webContents.getURL())

    if (permission === 'notifications') {
      // Approves the permissions request
      callback(true)
    }

    // Verify URL
    if (parsedUrl.protocol !== 'https:' || parsedUrl.host !== 'example.com') {
      // Denies the permissions request
      return callback(false)
    }
 })
```

When I try to add this block to my _main.js_, the application crashes with a segmentation fault on startup. After trial and error, I found that it works only after the application is ready and the main window has been created. 

In addition, I have no clue where _some-partition_ is coming from or what value I should use for my application. I found `session.defaultSession.webRequest` in the example for _CSP HTTP headers_ and it looks like a better solution coming from the tutorial. Is that correct or are there any drawbacks to that?

Also it's confusing that there is a `return` in the second `if`.

In accordance with the tutorial, my suggestion would be to change the sample code to this:

```js
const { app, session } = require('electron')
const { URL } = require('url')

app.whenReady().then(() => { 
  // Your function responsible for creating the BrowserWindow and loading your web application
  createWindow();
}).then(() => {
session
  .defaultSession
  .webRequest
  .setPermissionRequestHandler((webContents, permission, callback) => {
    const parsedUrl = new URL(webContents.getURL())

    if (permission === 'notifications') {
      // Approves the permissions request
      callback(true)
      return
    }

    // Verify URL
    if (parsedUrl.protocol !== 'https:' || parsedUrl.host !== 'example.com') {
      // Denies the permissions request
      callback(false)
      return
    }

    // Default is deny
  })
})
```
  

### 7. Define a Content Security Policy

Original example: 

```js
const { session } = require('electron')

session.defaultSession.webRequest.onHeadersReceived((details, callback) => {
  callback({
    responseHeaders: {
      ...details.responseHeaders,
      'Content-Security-Policy': ['default-src \'none\'']
    }
  })
})
```

Same issue as above - the code as it is leads to a segmentation fault and only works after the window has been created. In addition, as someone who hasn't had anything to do with CSPs before, it would be nice to have an example with multiple values. I had assumed additional values would be provided as additional array elements, instead they are separated by semi-colons.

My suggestion for this block would be:

```js
const { session } = require('electron')

app.whenReady().then(() => {
   // Your function responsible for creating the BrowserWindow and loading your web application
  createWindow();
}).then(() => {
  session.defaultSession.webRequest.onHeadersReceived((details, callback) => {
    callback({
      responseHeaders: {
        ...details.responseHeaders,
        'Content-Security-Policy': ["default-src 'none'"]
        // Multiple policies are provided like this, going from specific to general
        // 'Content-Security-Policy': ["img-src 'self'; script-src 'self' https://apis.example.com; default-src 'none'"]
      }
    })
  })
})
```
  
It may also be useful to provide minimal examples for testing if the security measures are working. I could provide small examples for 5, 13 and 14 if considered useful.

I'll try to add a pull request to the issue - but I'm new to Electron and GitHub, so please be patient ;)