Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
react-ssr-prepass
Advanced tools
react-dom/server
does not have support for suspense yet.
react-ssr-prepass
offers suspense on the server-side today, until it does. ✨
react-ssr-prepass
is a partial server-side React renderer that does a prepass
on a React element tree and suspends when it finds thrown promises. It also
accepts a visitor function that can be used to suspend on anything.
You can use it to fetch data before your SSR code calls renderToString
or
renderToNodeStream
.
⚠️ Note: Suspense is unstable and experimental. This library purely exists since
react-dom/server
does not support data fetching or suspense yet. This two-pass approach should just be used until server-side suspense support lands in React.
It's quite common to have some data that needs to be fetched before server-side rendering and often it's inconvenient to specifically call out to random fetch calls to get some data. Instead Suspense offers a practical way to automatically fetch some required data, but is currently only supported in client-side React.
react-ssr-prepass
offers a solution by being a "prepass" function
that walks a React element tree and executing suspense. It finds all
thrown promises (a custom visitor can also be provided) and waits for
those promises to resolve before continuing to walk that particular
suspended subtree. Hence, it attempts to offer a practical way to
use suspense and complex data fetching logic today.
A two-pass React render is already quite common for in other libraries
that do implement data fetching. This has however become quite impractical.
While it was trivial to previously implement a primitive React renderer,
these days a lot more moving parts are involved to make such a renderer
correct and stable. This is why some implementations now simply rely
on calling renderToStaticMarkup
repeatedly.
react-ssr-prepass
on the other hand is a custom implementation
of a React renderer. It attempts to stay true and correct to the
React implementation by:
ReactPartialRenderer
react-is
First install react-ssr-prepass
alongside react
and react-dom
:
yarn add react-ssr-prepass
# or
npm install --save react-ssr-prepass
In your SSR code you may now add it in front of your usual renderToString
or renderToNodeStream
code:
import { createElement } from 'react'
import { renderToString } from 'react-dom/server'
import ssrPrepass from 'react-ssr-prepass'
const renderApp = async App => {
const element = createElement(App)
await ssrPrepass(element)
return renderToString(element)
}
Additionally you can also pass a "visitor function" as your second argument. This function is called for every React class or function element that is encountered.
ssrPrepass(<App />, (element, instance) => {
if (element.type === SomeData) {
return fetchData()
} else if (instance && instance.fetchData) {
return instance.fetchData()
}
})
The first argument of the visitor is the React element. The second is
the instance of a class component or undefined. When you return
a promise from this function react-ssr-prepass
will suspend before
rendering this element.
You should be aware that react-ssr-prepass
does not handle any
data rehydration. In most cases it's fine to collect data from your cache
or store after running ssrPrepass
, turn it into JSON, and send it
down in your HTML result.
react-apollo
Instead of using react-apollo
's own getDataFromTree
function, react-ssr-prepass
can be used instead. For this to work, we will have to write a visitor function
that knows how to suspend on react-apollo
's Query
component.
Luckily this is quite simple, since all we need to do is call the fetchData
method on the Query
component's instance.
ssrPrepass(<App />, (_element, instance) => {
if (instance !== undefined && typeof instance.fetchData === 'function') {
return instance.fetchData()
}
})
Since we're now calling fetchData
when it exists, which returns a Promise
already, ssrPrepass
will suspend on <Query>
components.
More information can be found in Apollo's own docs
This library is (luckily) not a reimplementation from scratch of
React's server-side rendering. Instead it's mostly based on
React's own server-side rendering logic that resides in its
ReactPartialRenderer
.
The approach of doing an initial "data fetching pass" is inspired by:
FAQs
A custom partial React SSR renderer for prefetching and suspense
The npm package react-ssr-prepass receives a total of 76,134 weekly downloads. As such, react-ssr-prepass popularity was classified as popular.
We found that react-ssr-prepass demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.