←back to thread

Denial of service and source code exposure in React Server Components

(react.dev)
298 points sangeeth96 | 1 comments | 11 Dec 25 20:46 UTC | HN request time: 0s | source
Show context
chuckadams ◴[11 Dec 25 21:06 UTC] No.46237166[source]▶
I remember when the point of an SPA was to not have all these elaborate conversations with the server. Just "here's the whole app, now only ask me for raw data."
replies(7): >>46237234 #>>46237514 #>>46237562 #>>46237703 #>>46237856 #>>46238657 #>>46239228 #
mubou2 ◴[12 Dec 25 00:09 UTC] No.46239228[source]▶
It's funny (in a "wtf" sort of way) how in C# right now, the new hotness Microsoft is pushing is Blazor Server, which is basically old-school .aspx Web Forms but with websockets instead of full page reloads.

Every action, every button click, basically every input is sent to the server, and the changed dom is sent back to the client. And we're all just supposed to act like this isn't absolutely insane.

replies(7): >>46239539 #>>46239898 #>>46239981 #>>46240135 #>>46240268 #>>46240784 #>>46240850 #
1. oefrha ◴[12 Dec 25 04:23 UTC] No.46240850[source]▶
Yes, I say this every time this topic comes up: it took many years to finally have mainstream adoption of client-side interactivity so that things are finally mostly usable on high latency/lossy connections, but now people who’re always on 10ms connections are trying to snatch that away so that entirely local interactions like expanding/collapsing some panels are fucked up the moment a WebSocket is disconnected. Plus nice and simple stateless servers now need to hold all those long-lived connections. WTF. (Before you tell me about Alpine.js, have you actually tried mutating state on both client and server? I have with Phoenix and it sucks.)