Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SPAs Are Dead?

leastprivilege.com

Post reply on HN
Print view View original

61–70 of 118 posts

Re: SPAs Are Dead?

#61

Post by Cederfjard »

arendtio wrote: post #58
kreetx wrote: post #48

Earlier quoted context omitted.

I don't quite get what you mean. If the cross-origin server (to your app) wants to be consumed then it will respond with the correct headers. And if the server is under your control then you can configure it so.

For non-browser apps the server doesn't have to explicitly allow it. A simple curl can access any server it wants. If y browser based apps wants to access another server, that server needs to be configured to allow it (because of the Same Origin Policy) and how many servers do you know that allow anybody to access them via CORS? So take for example a WebDAV server. In theory, you could build a web based app, that can…

Not all apps need to contact third-party servers, so the way you categorically claim that building cross site web apps is next to impossible seems a bit exaggerated?

Edit: Unless you don’t consider it ”cross site” if you control the API server?

Re: SPAs Are Dead?

#62

Post by shock-value »

dkarras wrote: post #56
shock-value wrote: post #46

Earlier quoted context omitted.

A good option is doing both. Store a security token in localStorage and additionally store a secure signature for it in a secure, HTTP-only cookie. On your backend, verify validity of both the token and its additional signature contained in the cookie.

I don't believe it adds any meaningful security that justifies the cost (development, testing, hardening, scaling the state across servers if necessary etc.) With security "more complicated" does not necessarily mean "more secure". Doing it without multiplying the number of ways things can go wrong is deceptively hard.

With this method there is no additional per-user state, fortunately.

Re: SPAs Are Dead?

#63

Post by tomComb »

hawski wrote: post #55

I hoped that designers learned something and decided to stop the war against their users. I did not hold my breath. To clarify I have nothing against actual web applications like an image editor or a game. However a wiki (I don't appreciate Notion), an online shop or a damned blog should not be one. I want my history, link copying, bookmarking, middle-clicks and Ctrl/Cmd-clicks to work as intended.

I want all those things too, but not clear on how you think notion should be implemented.

I use it exclusively in the browser on a laptop. I find it slow but I do not think that is the fault of browser tech or SPA architecture, and I assume it will get addressed.

Re: SPAs Are Dead?

#64

Post by kreetx »

arendtio wrote: post #58
kreetx wrote: post #48

Earlier quoted context omitted.

I don't quite get what you mean. If the cross-origin server (to your app) wants to be consumed then it will respond with the correct headers. And if the server is under your control then you can configure it so.

For non-browser apps the server doesn't have to explicitly allow it. A simple curl can access any server it wants. If y browser based apps wants to access another server, that server needs to be configured to allow it (because of the Same Origin Policy) and how many servers do you know that allow anybody to access them via CORS? So take for example a WebDAV server. In theory, you could build a web based app, that can…

I would think any service that wants to be consumed will have CORS configured?

All else should be forbidden, that is the whole point of CORS.

Re: SPAs Are Dead?

#65

Post by CivBase »

austincheney wrote: post #60

A better way to think about it: Who wants SPAs more, UI developers or their users? If the demands of the developers out pace the demands of their users AND those demands primarily determine product design decisions the product is not all designed to benefit the user despite developers pleadings to the contrary. That is a very pronounced example of bias.

Users just want pages to load fast. UI developers (presumably) just want to maximize user happiness.

A SPA is just a way to front-load resources for a website so users don't have to re-load redundant resources for each new page. Whether that is actually worthwhile for the user depends largely on how many redundant resources a site has and how many pages a user is likely to request in a single session. SPAs are a situationally useful tech just like blockchain, machine learning, JS component frameworks, etc.

Re: SPAs Are Dead?

#66

Post by layoutIfNeeded »

arendtio wrote: post #58
kreetx wrote: post #48

Earlier quoted context omitted.

I don't quite get what you mean. If the cross-origin server (to your app) wants to be consumed then it will respond with the correct headers. And if the server is under your control then you can configure it so.

For non-browser apps the server doesn't have to explicitly allow it. A simple curl can access any server it wants. If y browser based apps wants to access another server, that server needs to be configured to allow it (because of the Same Origin Policy) and how many servers do you know that allow anybody to access them via CORS? So take for example a WebDAV server. In theory, you could build a web based app, that can…

Well, WebDAV clients don’t usually run untrusted scripts downloaded from random servers, so they don’t need CORS.

In this sense (i.e. running dubious scripts from random untrusted sources) the closest thing to browsers would be npm, although its centralized nature (mostly) prevents malicious actors causing too much damage.

Re: SPAs Are Dead?

#67

Post by echelon »

sly010 wrote: post #43

What the author describes was never a good idea anyway imho. We will just have to learn to point a subdomain to third party servers.

Or services we integrate with will have to start emitting the correct headers.

Re: SPAs Are Dead?

#68

Post by jmkni »

hawski wrote: post #55

I hoped that designers learned something and decided to stop the war against their users. I did not hold my breath. To clarify I have nothing against actual web applications like an image editor or a game. However a wiki (I don't appreciate Notion), an online shop or a damned blog should not be one. I want my history, link copying, bookmarking, middle-clicks and Ctrl/Cmd-clicks to work as intended.

> I want my history, link copying, bookmarking, middle-clicks and Ctrl/Cmd-clicks to work as intended.

In a well designed SPA, these will all work.

Re: SPAs Are Dead?

#69

Post by kreetx »

zyemuzu wrote: post #54
kreetx wrote: post #48

Earlier quoted context omitted.

I don't quite get what you mean. If the cross-origin server (to your app) wants to be consumed then it will respond with the correct headers. And if the server is under your control then you can configure it so.

This. I suppose that's what has me confused about both the blog post and comment, i.e. why would you not control your servers?

Not entirely sure what parent meant but it seems that many web developers are still confused as to why they can't consume any site on the internet from the front end.

Re: SPAs Are Dead?

#70

Post by adrr »

hawski wrote: post #55

I hoped that designers learned something and decided to stop the war against their users. I did not hold my breath. To clarify I have nothing against actual web applications like an image editor or a game. However a wiki (I don't appreciate Notion), an online shop or a damned blog should not be one. I want my history, link copying, bookmarking, middle-clicks and Ctrl/Cmd-clicks to work as intended.

They work perfectly fine under a SPA. SPA pushes history which lets the back button work and you can bookmark the URls. They have real URLs so you can create tabs.

Go look at https://www.target.com/ and see if you can tell difference between SPA and regular web page except for the speed aspect.

Post reply on HN