Scripting in the 3rd Party True Tales of Horror and Hope
summary
Third-party scripts load as tiny async loaders, serve per-customer config, and must be cached and CDN-hosted to handle 1 billion pageviews/month while avoiding blocking the page. Real failures include monkey-patched JSON.stringify and Prototype-style globals, an XHR analytics switch that broke checkout by other scripts, and a UMD race condition where RequireJS triggers sporadic errors. Practical defenses include stupid iframe tricks to get a clean window, CORS/easyXDM for cross-domain calls, integration tests against many browsers (Sauce Labs/BrowserStack), and proxy-based live testing (Charles/Fiddler).
AI-written summary · about
chapters (12)
- 0:00Introduction and speaker intro
- 1:08Defining third-party scripts
- 3:36Integration and delivery methods
- 8:17Loading strategies and performance
- 10:23Security considerations for scripts
- 11:04Building defensively like a guest
- 14:15JavaScript environment challenges
- 16:42Real-world scripting horror stories
- 18:52Cross-domain requests and solutions
- 20:00Tools testing and iteration
- 24:40Testing on production sites
- 25:02Final notes and resources
related talks
56mThird Party Scripts
01h 04mJavaScript's Most Wanted
40mHostile JavaScript: Attacking and Defending the Browser
29mYour Scripts In My Page - What Could Possibly Go Wrong?
22m#notalljavascript (How to deal with 3rd party JS)
59mThe Final Frontier: Security APIs in Modern Browsers
31mAn introduction to Nuxt Scripts
33mHacking your Front-End Apps