search

IdentityModel / oidc-client-js

OpenID Connect (OIDC) and OAuth2 protocol support for browser-based JavaScript applications
Apache License 2.0
2.43k stars 842 forks source link

Large increase in size of oidc-client.rsa256.js #1292

Open notclive opened 3 years ago

notclive commented 3 years ago

dist/oidc-client.rsa256.min.js jumped from 170 KB in 1.11.0 to 800 KB in 1.11.1

We used oidc-client.rsa256.min.js because it was significantly smaller than the other artifacts, my understanding is that oidc-client.rsa256.min.js is oidc-client without the jsrsasign library for clients that don't need to generate tokens.

I haven't been able to identify what change in 1.11.1 caused the jump in size.

brockallen commented 3 years ago

Hmm, odd. Thanks for letting me know. I'll have a look.

notclive commented 3 years ago

I've looked into this a little bit, the rsa file contains safe-buffer 5 times. safe-buffer appears to be a node.js library so probably shouldn't be included at all. I haven't worked out where it's coming from.

brockallen commented 3 years ago

I updated jsrsasign in 1.11.1 -- I bet it's something in there.

brockallen commented 3 years ago

Ok, the updated jsrsasign was not the issue. Part of it seems to be the update to cypto to v4.0.0 (to 470K), and webpack v4.46.0 (to 800K). I'm a bit confused why the slim is that size and the normal/core library is smaller... Feel free to investigate more. I am getting pulled onto other work ATM, so you might get to a solution faster than I.

brockallen commented 3 years ago

Hmm, and in fact if I leave webpack at the latest and revert crypto back to the (vulnerable) "crypto-js": "^3.1.9-1" then it's back down to 170K. So yea, I guess it's something specifically in the crypto package.

brockallen commented 3 years ago

Looks like they're aware of the issue: https://github.com/brix/crypto-js/issues/321. So there's not much to do here until they fix/update I think.