←back to thread

Denial of service and source code exposure in React Server Components

(react.dev)
298 points sangeeth96 | 2 comments | 11 Dec 25 20:46 UTC | HN request time: 0s | source
1. tills13 ◴[12 Dec 25 01:41 UTC] No.46239893[source]▶
Y'all are so pessimistic. React Server Components are great. React is a complex piece of software. Bugs happen.
replies(1): >>46239944 #
2. ipnon ◴[12 Dec 25 01:47 UTC] No.46239944[source]▶
Personally I prefer simple software without bugs! This security vulnerability highlights a serious issue with React. It’s a SPA framework, a server side framework, and a functional component library all at the same time. And it’s apparently getting so complex that it’s introducing source code exposures.

I’m not interested in flame wars per se, but I can tell you there are better alternatives, and that the closer you stay towards targeting the browser itself the better, because browser APIs are at least an order of magnitude more secure and performant than equivalent JS operations.