
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
react-lazy-route
Advanced tools
A simple yet elegant wrapper around react-router-dom's Route to lazy load components
A simple yet elegant and flexible wrapper around react-router-dom's Route to lazy load components.
# Using Yarn
$ yarn add react-lazy-route
# Using NPM
$ npm install --save react-lazy-route
import React, { Component } from 'react'
import { BrowserRouter as Router } from 'react-router-dom'
import LazyRoute from 'react-lazy-route'
const Home = () => import('./home/Home')
const SignIn = () => import('./auth/SignIn')
const SignUp = () => import('./auth/SignUp')
class App extends Component {
render () {
return (
<Router>
<div>
<LazyRoute exact path='/' render={Home} />
<LazyRoute path='/auth/signin' render={SignIn} />
<LazyRoute path='/auth/signup' render={SignUp} />
</div>
</Router>
)
}
}
export default App
You can still authenticate components in several ways, using HOCs, for example. But <LazyRoute /> makes it extremely easy to restrict access to your routes, given you a granular and flexible access control mechanism.
It also guarantees the browser to not even try to load the component if the user dosn't have the access level required.
You can also customize what happens when access to a route is forbidden. See the onForbidden prop bellow.
Here's an example where the user can view a list of posts but can't add new ones:
import React, { Component } from 'react'
import { connect } from 'react-redux'
import { BrowserRouter as Router, Switch } from 'react-router-dom'
import LazyRoute from 'react-lazy-route'
import { enhanceUser } from './services/user'
const PostList = () => import('./post/list')
const PostForm = () => import('./post/form')
class App extends Component {
render () {
return (
<Router>
<div>
<Switch>
<LazyRoute
path='/posts/add'
render={PostForm}
restrict
allow={this.user.can('add', 'posts')} />
<LazyRoute
path='/posts'
render={PostList}
restrict
allow={this.user.can('list', 'posts')} />
</Switch>
</div>
</Router>
)
}
}
function mapStateToProps ({ auth }) {
return {
user: enhanceUser(auth.user)
}
}
export default connect(mapStateToProps)(App)
You can use the same props available for the react-router-dom's Route component. The only difference is that the render prop must receive a function that returns a Promise which resolves with the component (more info on this here). Also, off course, since we're using render, we won't use de component prop.
Besides the Route props, <LazyRoute /> accepts additional props that makes it easy to handle a bunch of scenarios.
onLoadingShows while the component is being loaded.
Accepts:
function which receives the props from the <Route /> and must return a valid React element or null.Default:
null
import Spinner from './custom/Spinner'
<LazyRoute
path='/auth/signin'
render={SignIn}
onLoading={Spinner} />
<LazyRoute
path='/auth/signin'
render={SignIn}
onLoading={<Spinner color='blue' />} />
<LazyRoute
path='/auth/signin'
render={SignIn}
onLoading={(props) => {
console.log('Custom loading logic...')
return null
}} />
onErrorShows if the component fails to load.
Accepts:
function which receives the error object and the props from the <Route /> and must return a valid React element or null.String being a path to redirect the user to (passed to react-router-dom's <Redirect />).Object to redirect the user to (passed to react-router-dom's <Redirect />).Default:
<div className='lazy-route-error'>Couldn't load component</div>
import CustomError from './custom/Error'
<LazyRoute
path='/auth/signin'
render={SignIn}
onError={CustomError} />
<LazyRoute
path='/auth/signin'
render={SignIn}
onError={<CustomError message='Could not load SignIn' />} />
<LazyRoute
path='/auth/signin'
render={SignIn}
onError={(err, props) => {
console.log(err)
return null
}} />
<LazyRoute
path='/auth/signin'
render={SignIn}
onError='/505' />
<LazyRoute
path='/auth/signin'
render={SignIn}
onError={{
pathname: '/505',
state: {
error: 'Could not load SignIn'
}
}} />
restrict and allowThis two props work together. restrict disables free access to a route, whereas allow tells <LazyRoute /> when to grant access to that route. Both props accepts a Boolean.
<LazyRoute
path='/user/dashboard'
render={Dashboard}
restrict
allow={authenticated} />
onForbiddenShows when the user dosn't have access to the route.
Accepts:
function which receives the the props from the <Route /> and must return a valid React element or null.String being a path to redirect the user to (passed to react-router-dom's <Redirect />).Object to redirect the user to (passed to react-router-dom's <Redirect />).Default:
<div className="lazy-route-forbidden">Permission denied</div>
import ForbiddenMessage from './custom/Error'
const PrivateFeature = () => import('./private/Feature')
<LazyRoute
path='/private/feature'
render={PrivateFeature}
restrict
allow={authenticated}
onForbidden={ForbiddenMessage} />
<LazyRoute
path='/private/feature'
render={PrivateFeature}
restrict
allow={authenticated}
onForbidden={<ForbiddenMessage message='Permission denied' />} />
<LazyRoute
path='/private/feature'
render={PrivateFeature}
restrict
allow={authenticated}
onForbidden={(props) => {
console.log('Custom logic when permission is denied')
return null
}} />
<LazyRoute
path='/private/feature'
render={PrivateFeature}
restrict
allow={authenticated}
onForbidden='/401' />
<LazyRoute
path='/private/feature'
render={PrivateFeature}
restrict
allow={authenticated}
onForbidden={{
pathname: '/401',
state: {
error: 'Permission denied'
}
}} />
noReferrerIf you chose to redirect the user onError or onForbidden using a String, <LazyRoute /> will add a from property to the props.location.state Object. This is useful, for example, when you want to redirect the user to the route he tried to access earlier and got redirected to a login page. You can prevent this behavior by adding this prop to your <LazyRoute />. If you redirect using an Object
<LazyRoute
path='/private/feature'
render={PrivateFeature}
onForbidden='/401'
noReferrer />
Contributions are welcome and encouraged. Until now, this was only manually tested, since I don't have any experience on testing React Router. So, if anyone are whiling to write these tests or helping me with this, I'll gladly credit the work here.
This software is provided free of charge and without restriction under the MIT License
FAQs
A simple yet elegant wrapper around react-router-dom's Route to lazy load components
We found that react-lazy-route demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.