WICG / Realms-Initialization-Control

Introduce security controls to same origin realms in web applications
MIT License
15 stars 0 forks source link

What is the performance impact of RIC? #17

Closed simon-friedberger closed 2 months ago

simon-friedberger commented 2 months ago

What is the expected performance impact of RIC? My understanding is that RIC is trying to make it possible to decide which scripts get executed first in a new realm. Therefore all scripts will be blocked by the initialization script.

I don't have anything ready but I believe similar ideas in the past have failed because of the impact on first paint.

weizman commented 2 months ago

Naturally, this will introduce an impact, but that is somewhat by design, if you want to control the creation phase of same origin realms within your app (to which you are not obligated to opt-in to).

The current alternative is that web apps that wish to address this issue integrate snow-like solutions that solve this problem using JS, which is necessarily inferior to a built-in solution such as the proposed RIC.

Those who need this will see a perf improvement, migrating from a user-land solution to a native-based one. Those who find this to not be worth it these days, will either continue to think so or perhaps change their minds given how RIC will be faster than current user-land alternatives.

Would love to be referenced to past attempts, but since this is a security feature, in which running first is crucial, the introduction of a perf-impact to this (opt-in) feature is pretty natural - there's no other way to do this really.

weizman commented 2 months ago

closing with referral to https://github.com/WICG/Realms-Initialization-Control#performance