Using process.env to pass vars from main process to preload script in Electron - Good option?

I'm working on a webapp wrapped with Electron and I'm trying to find an easy way to pass vars from main process to preload.js so I could later get it from my BrowserWindow.

I know we can use IPC to send/receive datas from main process to the renderer view but I found this way sometimes too complex for just getting simple data.

Also, I don't want to set the BrowserWindow webPreferences.nodeIntegration to true because this can be a crack for XSS attack such as explained here.

I found a way (below) to pass vars from the main process to a contextBridge in the preload.js so I can later get these vars from the JS code of my BrowserWindow.

index.js (MAIN PROCESS)

process.env.MY_SUPER_VAR = 'Hello'

preload.js

const { contextBridge } = require("electron");
contextBridge.exposeInMainWorld(
    "electron", {
        mySuperVar : process.env.MY_SUPER_VAR
    });

script.js (loaded later from page.html)

console.log(window.electron.mySuperVar);// 'Hello'

Is it a right way of doing it? Is it secure?
Any suggestions/advises/examples would be welcome. Thanks!

I'm the one who posted that comment you mentioned.

You can use process.env, but I'd recommend process.argv only for the reason that it's more in-line with the intended use of the property - (env is for environment-specific settings, argv are for application-specific settings), otherwise, they function in a similar enough way.

You can set argv values through the additionalArguments property on the BrowserWindow. As an example to refer to, I do this in my secure-electron-template repository.

Example

  win = new BrowserWindow({
    width: 800,
    height: 600,
    title: "Application is currently initializing...",
    webPreferences: {
      additionalArguments: [`--customValue=${value}`],
      preload: path.join(__dirname, "preload.js")
    }
  });

In your preload.js file you can pull the value out and use it as you like.

const arg = process.argv.filter(p => p.indexOf("--customValue=") >= 0)[0];
const argValue = arg.substr(arg.indexOf("=") + 1);

A word of caution, I'd recommend prefixing every element of additionalArguments with -- in order to pass the value correctly and also not include any \, it does not work when you do not follow these rules.