Load JS modules for web components as-needed [BREAKING CHANGE] #723
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
wwwillchen
force-pushed
the
load_js_modules_right
branch
from
c69cb1f to
a1bb72b
Compare
Merged
wwwillchen
added a commit
that referenced
this pull request
Aug 5, 2024
* bump to v0.11.0rc0 * bump to v0.11.0 * Update smoketest app with security policy (see: #723)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I discovered an issue with the way we're loading JS modules for web components where all the pages of the app will try to load the JS modules. This leads to either: a) unnecessarily loading JS modules or b) getting spammed with CSP errors because the other pages (which don't load the web component) will probably not have the right security policy (CSP) configuration. b) was happening on our own demo site.
This loads JS modules dynamically when a web component is called in a render loop. Note: JS module imports should be de-duped so re-importing the same module returns the same instance and is basically instant.
Breaking change: This PR introduces a breaking change for Mesop app developers using web components. You may need to add sites to:
Security_Policy(allowed_script_srcs=[..]Because web components are still in labs, I think it's OK to make this breaking change. I will also have a follow-up PR (#724) to make it easier to fix CSP errors.
Background: Based on w3c/webappsec#544, it sounds like when you load a module via
<script src="foo.js" type="module" nonce="...">, then the modules statically imported by foo.js are covered by the nonce.