Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
focus-trap-vue
Advanced tools
Vue component to trap the focus within a DOM element
npm install focus-trap focus-trap-vue@legacy
npm install focus-trap focus-trap-vue
This library exports one single named export FocusTrap
and requires
focus-trap
as a peer
dependency. So you can locally import the component or declare it globally:
import { FocusTrap } from 'focus-trap-vue'
Vue.component('FocusTrap', FocusTrap)
import { FocusTrap } from 'focus-trap-vue'
createApp(App)
.component('FocusTrap', FocusTrap)
.mount('#app')
Note this documentation is for Vue 3 and some props/events might not exist in the Vue 2 version
FocusTrap
can be controlled in three different ways:
active
Boolean propv-model:active
(uses the active
prop, Vue 3 only)activate
/deactivate
method on the componentThe recommended approach is using v-model:active
and it should contain one single child:
<focus-trap v-model:active="isActive">
<modal-dialog tabindex="-1">
<p>Do you accept the cookies?</p>
<button @click="acceptCookies">Yes</button>
<button @click="isActive = false">No</button>
</modal-dialog>
</focus-trap>
When isActive
becomes true
, it activates the focus trap. By default it sets
the focus to its child, so make sure the element is a focusable element. If it's
not you wil need to give it the tabindex="-1"
attribute. You can also
customize the initial element focused. This element should be an element that
the user can interact with. For example, an input. It's a good practice to
always focus an interactable element instead of the modal container:
<focus-trap v-model:active="isActive" :initial-focus="() => $refs.nameInput">
<modal-dialog>
<p>What name do you want to use?</p>
<form @submit.prevent="setName">
<label>
New Name
<input ref="nameInput" />
</label>
<button>Change name</button>
</form>
</modal-dialog>
</focus-trap>
FocusTrap
also accepts other props:
escapeDeactivates
: boolean
returnFocusOnDeactivate
: boolean
allowOutsideClick
: boolean | ((e: MouseEvent | TouchEvent) => boolean)
clickOutsideDeactivates
: boolean | ((e: MouseEvent | TouchEvent) => boolean)
initialFocus
: string | (() => Element)
Selector or function returning an ElementfallbackFocus
: string | (() => Element)
Selector or function returning an ElementdelayInitialFocus
: boolean
tabbableOptions
: FocusTrapTabbableOptions
Options passed to tabbableOptions
Please, refer to focus-trap documentation to know what they do.
FocusTrap
emits 2 events. They are in-sync with the prop active
activate
: Whenever the trap activatesdeactivate
: Whenever the trap deactivates (note it can also be deactivated by
pressing Esc or clicking outside)FocusTrap
can be used without v-model:active
. In that case, you will use the
methods and probably need to initialize the trap as deactivated, otherwise,
the focus will start as active:
<button @click="() => $refs.focusTrap.activate()">Show the modal</button>
<focus-trap :active="false" ref="focusTrap">
<modal-dialog>
<p>Hello there!</p>
<button @click="() => $refs.focusTrap.deactivate()">Okay...</button>
</modal-dialog>
</focus-trap>
Note the use of arrow functions, this is necessary because we are accessing
$refs
which are unset on first render.
FAQs
Vue component to trap the focus within a DOM element
The npm package focus-trap-vue receives a total of 31,369 weekly downloads. As such, focus-trap-vue popularity was classified as popular.
We found that focus-trap-vue demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.