[catern]

>And then - because not bundled - all the modules that will be used on another page will be cached already.

Why isn't anyone else mentioning this feature? I'm not a browser developer but this seems like a clear win, and indeed makes bundling unnecessary. I'm assuming that it's shared between domains, too - or are people's dependencies so fragmented that there's basically no sharing between domains?

[simonw]

I believe sharing cached code between domains has been almost entirely eliminated by browsers now, because it turned out to be a huge privacy leak: a malicious domain could attempt to load code that was used by another domain, time how long it took to load and use that to determine if the user had visited that other site.

Browsers fixed this by making the browser cache no longer shared between domains.

[catern]

Hm, I wonder if this could be circumvented by doing timing attacks against the CDN cache? That's still shared between domains...

[jakelazaroff]

It is not:

https://developers.google.com/web/updates/2020/10/http-cache...

https://developer.mozilla.org/en-US/docs/Web/Privacy/State_P...

[catern]

That's the cache in the browser, not the cache in the CDN.

[jakelazaroff]

Oh, I see what you’re saying. How could that possibly be exploited for a side channel attack, though? All it would tell an attacker is that someone requested the file before.

[tofflos]

The cache used to be shared between domains but that's no longer the case due to privacy concerns and limited effectiveness.

> As of Firefox v85 and Chrome v86 the browser cache will be partitioned, this means that the same resource included on two sites will have to be downloaded from the internet twice and cached separately.

Source https://www.peakhour.io/blog/cache-partitioning-firefox-chro....

[acdha]

This still helps other requests to the same origin, which is a very common situation if you don’t have the extra resources needed to get an SPA up to the same performance and reliability levels.

[forty]

In practice I think downloading many small files is actually slower than a single bigger file. It might not be so true today with http2 for example though.

[acdha]

HTTP/2 definitely changed that and is near-universally supported now. The biggest win is the ability to cache things independently: with bundles your servers and clients have to retransfer everything if a single byte changes, and most of the sites I’ve worked on don’t change most of their files every time they ship an update. A cold visit will usually be immeasurably different from a bundle but a warm visit is noticeably faster.

[kevingadd]

Yes, it's much slower pre-http2 since no modern browser actually does pipelining, so it's going to be a socket per file

HTTP2 fixes this by allowing multiple requests to occur in parallel on a single connection.

[forty]

In the specific case of JS import, it's still going to be pretty bad though, I guess, since you have to download a file, parse it to figure out the deps, then fetch them, parse them, etc, so you are limited in what you can do in parallel.

[eyelidlessness]

That’s what `modulepreload` &co is for. It’s a shame HTTP Push is dead, it was a much more general solution. But specifically for web pages the solution is more or less the same + 1 round trip (you won’t get the benefits of “push” until you at least process all the head>meta tags).

[qudat]

We already do this with a build step using a vendor bundle and an app bundle and it can be configured to create a bundle for each page.