←back to thread

Denial of service and source code exposure in React Server Components

(react.dev)
298 points sangeeth96 | 3 comments | 11 Dec 25 20:46 UTC | HN request time: 0.017s | source
Show context
chuckadams ◴[11 Dec 25 21:06 UTC] No.46237166[source]▶
I remember when the point of an SPA was to not have all these elaborate conversations with the server. Just "here's the whole app, now only ask me for raw data."
replies(7): >>46237234 #>>46237514 #>>46237562 #>>46237703 #>>46237856 #>>46238657 #>>46239228 #
tshaddox ◴[11 Dec 25 21:12 UTC] No.46237234[source]▶
That was indeed one of the main points of SPAs, but React Server Components are generally not used for pure SPAs.
replies(2): >>46237516 #>>46241009 #
reactordev ◴[11 Dec 25 21:36 UTC] No.46237516[source]▶
Correct, their main purpose is ecosystem lock-in. Because why return json when you can return html. Why even build a SPA when the old school model of server-side includes and PHP worked just fine? TS with koa and htmx if you must but server-side react components are kind of a waste of time. Give me one example where server side react components are the answer over a fetch and json or just fetching an html page?
replies(2): >>46237878 #>>46238984 #
1. nawgz ◴[11 Dec 25 23:46 UTC] No.46238984[source]▶
The only example that has any traction in my view are web-shops, which claim that time-to-render and time-to-interactivity are critical for customer retention.

Surely there are not so many people building e-commerce sites that server components should have ever become so popular.

replies(1): >>46239540 #
2. skydhash ◴[12 Dec 25 00:48 UTC] No.46239540[source]▶
The thing is time to render and interactivity is much more reliant on the database queries and the internet connection of the user than anything else. Now instead of a spinner or a progress bar in the toolbar of the browser, now I got skeleton loaders and use half of GB for one tab.
replies(1): >>46240826 #
3. nawgz ◴[12 Dec 25 04:18 UTC] No.46240826[source]▶
Not to defend the practice, I’ve never partaken, but I think there’s some legit timing arguments that a server renderer can integrate more requests faster thanks to being collocated with services and dbs.