Trusted local Fast
ipc.config.parser = 'fast';
ipc.connectTo('worker');Fast is already the default. It keeps the framed event path direct.
Pay only for the controls you select
Node.js runtime profiles
Raw, Fast, Guarded, and Assured are explicit Node.js message-path contracts. Configure one before creating a client or server; node-ipc selects the parser, receive, write, and logging handlers once.
Fast is defaultNo per-message flag pollingApplication security still required
Select the boundary
| Profile | Per-message node-ipc work | Use when | Do not assume |
|---|---|---|---|
| Raw | Direct Buffer write/read. No node-ipc framing, JSON, envelope, name, size, timeout, or pending-write checks. | Both peers are trusted and implement a tested caller-owned protocol. | Message boundaries, validation, or containment. |
| Fast | Delimiter framing and direct JSON event-envelope encode/decode. Malformed JSON closes a stream connection or resets UDP peer frame state. | Trusted local processes need the node-ipc event contract. | Size limits, safe event names, envelope validation, timeout, or backpressure limits. |
| Guarded | Fast plus frame and stream pending-write limits, object-envelope checks, event-name rules, and incomplete-frame timeout. | Peers have authenticated identities but input still needs protocol containment. | Payload-schema validation, peer identity, authorization, replay control, or rate limiting. |
| Assured | Guarded plus an explicit event allow-list. Network peers require mutually authenticated TLS; each Unix local server endpoint must be a direct child of the secure socket root, and clients must verify ownership. Built-in Assured local service rejects Windows because node-ipc cannot prove a named-pipe ACL. | A hostile network requires a narrow event surface, verified peer certificates, and application authorization. | Certification, key management, payload policy, or complete defense in depth. |
Rust shares the codec names, not every Node.js transport guarantee.
Rust Assured enforces guarded codec limits and the event allow-list. The application must establish and verify mutual TLS, Unix ownership, or an appropriate Windows pipe ACL around the supplied transport. Open the Rust boundary →
Configure before construction
Guarded service
ipc.config.parser = 'guarded';
ipc.config.maxMessageSize = 1024 * 1024;
ipc.config.maxPendingBytes = 8 * 1024 * 1024;
ipc.config.messageTimeout = 30_000;
ipc.serve();Assured network service
ipc.config.parser = 'assured';
ipc.config.allowedEvents = ['query', 'cancel'];
ipc.config.tls = {
private: '/secure/server.key',
public: '/secure/server.crt',
trustedConnections: '/secure/client-ca.crt',
requestCert: true,
rejectUnauthorized: true
};
ipc.serveNet('127.0.0.1', 8000);The client must likewise provide its key/certificate, trust the server CA, and keep rejectUnauthorized:true.
Caller-owned Raw
ipc.config.parser = 'raw';
// rawBuffer = true remains a compatibility alias
ipc.connectTo('binary-worker');
ipc.of['binary-worker'].on('data', consumeBuffer);Changing config later is not a security transition.
An existing endpoint retains the handlers selected when it was constructed. Disconnect or stop it, set the new configuration, and create a new endpoint.
Exact built-in controls
| Control | Raw | Fast | Guarded | Assured |
|---|---|---|---|---|
| Raw Buffer pass-through | Yes | No | No | No |
| JSON + delimiter framing | No | Yes | Yes | Yes |
| Malformed JSON contained | No | Yes | Yes | Yes |
| Object event envelope | No | No | Required | Required |
| Message + stream pending-write limits | No | No | Yes | Yes |
| Reserved/prototype-name rejection | No | No | Yes | Yes |
| Incomplete-frame timeout | No | No | Yes | Yes |
| Explicit event allow-list | No | No | No | Required |
| Verified mutual TLS required for network use | No | No | No | Yes |
| Verified owner-only Unix server root required locally | No | No | No | Yes; Windows local rejected |
Legacy payload-based socket IDs are separate from profiles and disabled by default. identifyPeer=true selects that lookup once, but data.id remains untrusted application input—not authenticated identity.
Operational fit, not certification
High-speed systems
Raw or Fast can fit low-latency trusted process graphs, games, media, telemetry, and high-frequency local services. The caller owns every omitted control.
Enterprise and internet services
Guarded can contain protocol abuse after peer identity is established. Add payload schemas, authorization, quotas, observability, and deployment hardening.
Cyber, government, or military evaluation
Assured provides a narrower protocol building block. A deployment still needs its mandated cryptography, identity, key management, audit, supply-chain, availability, incident-response, and accreditation controls.
Design rule
node-ipc supplies the race car. The application decides whether the operating environment needs minivan or armored-vehicle controls—and pays only for the selected path.
Measured profile cost
