SPAs Are Dead?

#1

Post by wstrange » Wed, Apr 07, 2021, 6:07 PM UTC

Re: SPAs Are Dead?

#2

Post by stepbeek » Wed, Apr 07, 2021, 6:11 PM UTC

Maybe I'm missing something, but this seems like a very narrow definition of SPA. A SPA can just sit on a different path from the API server and cross-site cookies aren't a problem. For instance, www.example.com/app and www.example.com/api

Re: SPAs Are Dead?

#3

Post by weird-eye-issue » Wed, Apr 07, 2021, 6:43 PM UTC

stepbeek wrote: post #2

Maybe I'm missing something, but this seems like a very narrow definition of SPA. A SPA can just sit on a different path from the API server and cross-site cookies aren't a problem. For instance, www.example.com/app and www.example.com/api

This is how I prefer to do it. No CORS pre-flight requests and messing with CORS settings

Re: SPAs Are Dead?

#4

Post by timw4mail » Wed, Apr 07, 2021, 6:47 PM UTC

Cookies suck. The interface is beyond terrible, they were never scoped properly, and they don't have to be used.

Browser storage (sessionStorage, localStorage) is perfectly valid for storing an authentication token.

Re: SPAs Are Dead?

#5

Post by yitianjian » Wed, Apr 07, 2021, 6:59 PM UTC

weird-eye-issue wrote: post #3

stepbeek wrote: post #2

Maybe I'm missing something, but this seems like a very narrow definition of SPA. A SPA can just sit on a different path from the API server and cross-site cookies aren't a problem. For instance, www.example.com/app and www.example.com/api

This is how I prefer to do it. No CORS pre-flight requests and messing with CORS settings

Seconding (thirding?) this.

I'm curious, are there any SPAs that aren't done this way?

Re: SPAs Are Dead?

#6

Post by tus88 » Wed, Apr 07, 2021, 6:59 PM UTC

How do people bridge the SPA/ORM gap, when no such gap exists in serverside rendering?

Re: SPAs Are Dead?

#7

Post by beckingz » Wed, Apr 07, 2021, 7:00 PM UTC

yitianjian wrote: post #5

weird-eye-issue wrote: post #3

Earlier quoted context omitted.

This is how I prefer to do it. No CORS pre-flight requests and messing with CORS settings

Seconding (thirding?) this. I'm curious, are there any SPAs that aren't done this way?

app.example.com vs api.example.com ?

Re: SPAs Are Dead?

#8

Post by paxys » Wed, Apr 07, 2021, 7:01 PM UTC

Sounds like an overreaction. The only thing affected by the browser changes is some third party authentication mechanisms, and those can be easily fixed (as mentioned in the article itself).

Re: SPAs Are Dead?

#9

Post by pier25 » Wed, Apr 07, 2021, 7:03 PM UTC

I prefer using cookies, but most SPAs actually use JWTs.

Re: SPAs Are Dead?

#10

Post by kostarelo » Wed, Apr 07, 2021, 7:03 PM UTC

timw4mail wrote: post #4

Cookies suck. The interface is beyond terrible, they were never scoped properly, and they don't have to be used. Browser storage (sessionStorage, localStorage) is perfectly valid for storing an authentication token.

By interface you mean.. the HTTP protocol? At least they can be scoped on the domain level. Browser storage can't.