Denial of service and source code exposure in React Server Components

Re:Denial of service and source code exposure in React Serve... by berekuk on Thursday December 11, 2025 @07:56PM (#46239616)

I've been using React since its initial release; I think both RSC and App Router are great, and things are better than ever.

It's the first stack that allows me to avoid REST or GraphQL endpoints by default, which was the main source of frontend overhead before RSC. Previously I had to make choices on how to organize API, which GraphQL client to choose (and none of them are perfect), how to optimize routes and waterfalls, etc. Now I just write exactly what I mean, with the very minimal set of external helper libs (nuqs and next-safe-action), and the framework matches my mental model of where I want to get very well.

Anti-React and anti-Next.js bias on HN is something that confuses me a lot; for many other topics here I feel pretty aligned with the crowd opinion on things, but not on this.

[ Parent | on HN ]

Re:Denial of service and source code exposure in React Serve... by c-hendricks on Thursday December 11, 2025 @08:20PM (#46239755)

Some of the anti-next might be from things like solid-start and tanstack-start existing, which can do similar things but without the whole "you've used state without marking as a client component thus I will stop everything" factor of nextjs.

Not to mention the whole middleware and being able to access the incoming request wherever you like.

[ Parent | on HN ]

Re:Denial of service and source code exposure in React Serve... by kyleee on Thursday December 11, 2025 @11:20PM (#46240834)

And vercel

[ Parent | on HN ]

Re:Denial of service and source code exposure in React Serve... by c-hendricks on Friday December 12, 2025 @11:25AM (#46245648)

That's true, can't blame people for having a bad taste of VC funded companies taking the reigns on open source projects.

[ Parent | on HN ]

Re:Denial of service and source code exposure in React Serve... by codemonkey-zeta on Thursday December 11, 2025 @09:11PM (#46240113)

Can you describe how rsc allows you to avoid rest endpoints? Are you just putting your rsc server directly on top of your database?

[ Parent | on HN ]

Re:Denial of service and source code exposure in React Serve... by berekuk on Thursday December 11, 2025 @10:53PM (#46240719)

If I control both the backend and the frontend, yes. Server-only async components on top of layout/page component hierarchy, components -> DTO layer -> Prisma. Similar to this: https://nextjs.org/blog/security-nextjs-server-components-ac...

You still need API routes for stuff like data-heavy async dropdowns, or anything else that's hard to express as a pure URL -> HTML, but it cuts down the number of routes you need by 90% or more.

[ Parent | on HN ]

Re:Denial of service and source code exposure in React Serve... by skydhash on Friday December 12, 2025 @05:32AM (#46242761)

You’re just shifting the problem from HTTP to an adhoc protocol on top of it.

[ Parent | on HN ]

Re:Denial of service and source code exposure in React Serve... by afavour on Friday December 12, 2025 @09:54AM (#46244707)

Yes but they’re also shifting the problem from one they explicitly have to deal with themselves to one the framework handles for them.

Personally I don’t like it but I do understand the appeal.

[ Parent | on HN ]

Re:Denial of service and source code exposure in React Serve... by skydhash on Friday December 12, 2025 @09:57AM (#46244733)

Maybe, but you go from one of the most tested protocol with a lot of tooling to another with not even a specification.

[ Parent | on HN ]