I do hope this means we can finally stop hearing about RSC. The idea is an interesting solution to problems that never should exist in the first place.
Denial of service and source code exposure in React Server Components
61–70 of 232 posts
Re: Denial of service and source code exposure in React Server Components
#62React patches one vulnerability and two more are revealed, just like a Hydra.
At this point you might as well deprecate RSC as it is clearly a contraption for someone trying to justify a promotion at Meta.
Maybe they are going to silently remove “Built RSC at Meta!” in their LinkedIn bios after this. So what other vulnerabilities are going to be revealed in React after this one?
Re: Denial of service and source code exposure in React Server Components
#63The JavaScript fanatics will downvote me for saying this, but I'll say this, "using a single JavaScript codebase on your client-side and server-side is like cooking food in your toilet, sooner or later, contamination is guaranteed" [1] 1 - https://ashishb.net/tech/javascript/
This isn't a Javascript problem, this is a React problem. You could theoretically rewrite React and RSC in any language and the outcome would be the same. Say Python ran in the browser natively, and you reimplented React on browser and server in Python. Same problem, not Javascript.
Re: Denial of service and source code exposure in React Server Components
#64Earlier quoted context omitted.
Thanks for the feedback, I adjusted it here so the first note is related to the impacted versions: https://github.com/reactjs/react.dev/pull/8195
I appreciate the follow up! I think it looks great now and doesn’t read as defensively anymore!
Yeah agreed, thanks again for the feedback. The priority here is clear disclosure and upgrade steps.
Re: Denial of service and source code exposure in React Server Components
#65Earlier quoted context omitted.
I was a fan of NextJS in the pages router era. You knew exactly where the line was between server and client code and it was pretty easy to keep track of that. Then I've began a new project and wanted to try out app router and I hated it. So many (to me common things) where just not possible because the code can run in the client and on the server so Headers might not always be available and it was just pure confusio…
I think we (the Next.js user community) need to organize and either convince Vercel to announce official support of the Pages router forever (or at least indefinitely, and stop posturing it as a deprecated-ish thing), or else fork Next.js and maintain the stable version of it that so many of us enjoyed. Every time Next comes up I see a ton of comments like this, everyone I talk to says this, and I almost never hear a…
I would highly recommend just checking out TanStack Router/Start instead. It fills a different niche, with a slightly different approach, that the Next.js app router just hasn't prioritized enabling anymore.
What app router has become has its ideal uses, but if you explicitly preferred the DX of the pages router, you might enjoy TanStack Router/Start even more.
Re: Denial of service and source code exposure in React Server Components
#66LOL. I must have divination powers. I am currently working on a UI framework and opened an issue just 3 weeks ago that says: *** Seems that server functions are all the rage. We are unlikely to have them. The main reason is that it ties the frontend and the backend together in undesirable ways. It forces a js backend upon people (what if I want to use Go for instance). The api is not client agnostic anymore. How to s…
I'm curious about your UI framework, is it public?
Not public yet. Under review.
Re: Denial of service and source code exposure in React Server Components
#67I'm only surprised it took this long for an exposure of backend data to the front end to be discovered in RSC
Re: Denial of service and source code exposure in React Server Components
#68I wonder what does these vulnerabilities mean for Facebook. As per my knowledge, Facebook's the biggest web app written in React.
This is about React Server Components, a subset/feature of React that can optionally be installed and used.
Apps that use React without server components are not affected.
Re: Denial of service and source code exposure in React Server Components
#69Re: Denial of service and source code exposure in React Server Components
#70Earlier quoted context omitted.
No, but it's primarily because Meta has their own server infrastructure already. RSCs are essentially the React team trying to generalize the data fetching patterns from Meta's infrastructure into React itself so they can be used more broadly. I wrote an extensive post and did a conference talk earlier this year recapping the overall development history and intent of RSCs, as best as I understand it from a mostly-ext…
So contrary to all other changes, this one was not done for Facebook to use. What was the reason behind RSC then?
Market capture?