←back to thread

Denial of service and source code exposure in React Server Components

(react.dev)
298 points sangeeth96 | 1 comments | 11 Dec 25 20:46 UTC | HN request time: 0.227s | source
Show context
ashishb ◴[11 Dec 25 22:21 UTC] No.46238074[source]▶
The JavaScript fanatics will downvote me for saying this, but I'll say this, "using a single JavaScript codebase on your client-side and server-side is like cooking food in your toilet, sooner or later, contamination is guaranteed" [1]

1 - https://ashishb.net/tech/javascript/

replies(3): >>46238744 #>>46240063 #>>46241047 #
leptons ◴[11 Dec 25 23:20 UTC] No.46238744[source]▶
This isn't a Javascript problem, this is a React problem. You could theoretically rewrite React and RSC in any language and the outcome would be the same. Say Python ran in the browser natively, and you reimplented React on browser and server in Python. Same problem, not Javascript.
replies(1): >>46239061 #
ashishb ◴[11 Dec 25 23:54 UTC] No.46239061[source]▶
> This isn't a Javascript problem, this is a React problem.

It happened with Next.js as well https://github.com/vercel/next.js/discussions/11106

> Say Python ran in the browser natively, and you reimplented React on browser and server in Python. Same problem, not Javascript.

Yes.

And since Python does not natively run in the browser, that mistake never happens. With JavaScript, the desire to have "backend and frontend in a single codebase" requires active resistance.

replies(2): >>46239711 #>>46241013 #
1. leptons ◴[12 Dec 25 04:59 UTC] No.46241013[source]▶
>And since Python does not natively run in the browser, that mistake never happens.

Did you even bother to read my comment? Try again, please. Next time don't skip over parts.