-
Notifications
You must be signed in to change notification settings - Fork 0
Open
Description
At the moment, this library loads messo.min.js
via the Chameleon CDN:
Lines 13 to 17 in 4757952
i=d.createElement("script");if(w[c]||(w[c]={}),!w[c].root){w[c].accountToken=t,w[c].location=w.location.href.toString(),w[c].fastUrl=fastUrl||'https://fast.trychameleon.com/', | |
w[c].now=new Date;for(var s=0;s<m.length;s++){!function(){var t=w[c][m[s]+"_a"]=[];w[c][m[s]]=function(){t.push(arguments);};}();} | |
i.src=w[c].fastUrl+"messo/"+t+"/messo.min.js", | |
i.async=!0,d.head.appendChild(i);} | |
} |
This has some adverse implications:
- It means that users of this package need to allow loading scripts from this CDN via their Content-Security-Policy
- It requires an extra request, which hurts page load performance
- It makes things opaque to JavaScript bundlers (they cannot optimize into messo, because the script is not visible at build time)
- It makes things more fragile (if the request fails, it can prevent page loading)
I think it would be preferable to declare messo as a dependency of this package instead, and have your build bundle it into a dist/chmln.js
file at build time if needed.
Metadata
Metadata
Assignees
Labels
No labels