zxcvbn-ts / zxcvbn

Low-Budget Password Strength Estimation
https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/wheeler
MIT License
907 stars 72 forks source link

Tree shaking doesn't seem to work properly #198

Closed lekoaf closed 1 year ago

lekoaf commented 1 year ago

I did a bundle analysis with the 2.x version where I imported the translations directly from dist/translations and then did a new analysis today with the 3.x version where I do import { translations as enTranslations } from '@zxcvbn-ts/language-en'

And the sizes got much, much worse as you can see in the image.

2023-05-08_11-39

We are happy to help analyse the problem if you'd like, because we really like this project.

MrWook commented 1 year ago

True, i think the sideEffects property in the package.json is missing.

I test it with a plain esbuild repo but it won't use the esm package automatically so i guess after setting the sideEffects property you still need to come up with a way to use the esm file instead of the cjs file 🤔 Because currently this works: import { translations } from "@zxcvbn-ts/language-en/dist/index.esm.js" But not this import { translations } from "@zxcvbn-ts/language-en"

So the sideEffects goes in the right directions because previously both imports didn't work

lekoaf commented 1 year ago

Update!

2023-05-11_08-07

MrWook commented 1 year ago

Thanks for the update! Nice to know that the sideEffects flag did the trick for you :)

codepunkt commented 1 year ago

@lekoaf @MrWook I'm not sure I understand. For me, the Signup chunk checking the password strength has a size of ~2.5 megabytes. Can this get significantly smaller? If yes: How?

MrWook commented 1 year ago

@codepunkt do you import more than the translations? Lekoaf is only importing the translations which are small json files. He is not using the dictionaries which are quite big as you can see.

Be aware that not using the dictionaries is not recommended and will hit the scoring negatively. As most of the scoring comes from comparing the password with those dictionaries. But its up to you if you want to decrease the bundle size of one specific page for password security.

codepunkt commented 1 year ago

I'd rather have the dictionaries on server and do the scoring there 🤷🏻

lekoaf commented 1 year ago

Yupp, we are only using the translations. The dictionaries were too big for our bundles, especially since we are using several languages, and will add more soon. The repeating patterns etc is good enough for us right now.