Public CDN's aren't useful anymore
Tags: cdn, javascript
Published: 2022-04-01 02:30:33

Public CDN’s were supposed to help page speed, but things have changed in 2019. Services like [Google Fonts](https://developers.google.com/speed/libraries), [Cloudflare’s cdnjs](https://cdnjs.com/), [jsDelivr](https://www.jsdelivr.com/) and [Google Hosted Libraries](https://developers.google.com/speed/libraries) may not help make sites load faster anymore.

---

## Shared caches don’t work anymore
Today, the primary advantage of public CDN’s is no longer supported by modern browsers.

Resources (like .js files) loaded by a site the user visits <mark>will no longer be cached for other sites they visit.</mark> Browsers have stopped having shared caches around Sep 2019 ([Chrome 77](https://chromestatus.com/feature/5730772021411840), [Firefox](https://bugzilla.mozilla.org/show_bug.cgi?id=1536058)). This has all been done to address a cross-site leak security issue reported on March 2019:

- [Shared Cache is Going Away](https://www.jefftk.com/p/shared-cache-is-going-away) (jefftk.com)
- [sirdarckcat: HTTP Cache Cross-Site Leaks](http://sirdarckcat.blogspot.com/2019/03/http-cache-cross-site-leaks.html) (sirdarckcat.blogspot.com)

---

## About public CDN’s
CDN’s were supposed to help sites load faster. For example, a popular library like jQuery can be loaded from a CDN by one site, making it load faster for other sites the user will visit who would use the same CDN.

```html

<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js"></script>

```

> ☝Google has been running a CDN serving popular JavaScript libraries. (via [Google](https://developers.google.com/speed/libraries))

---

## Other issues with public CDN's

📉 *Downtime* — Downtime in Public CDN’s will impair the service of your site. Compare this to something like npm or Rubygems where downtime will affect builds and deploys, but not users.

⚠ *Blocked in some regions* — There are countries that block Google domains, which will impair your site if it loads critical assets from Google Fonts or Google Hosted Libraries.

🥷 *Resource integrity issues* — In the event of a compromised public CDN, malicious code can be inserted into your site. This can be mitigated using [Subresource Integrity (SRI)](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity) (ie, `<script src="..." integrity="(sha384_hash_here)">`) but maintaining these can be a hassle.

---

## Are public CDN’s still useful?
While public CDN’s have been heavily nerfed, some have found it to be useful for other reasons.

💻 *Code examples* — Using Google Fonts can be useful in code examples. There are even CDN’s like [skypack](https://www.skypack.dev/) that will create optimised versions of npm packages, allowing code examples to skip having build & compile pipelines.

🏗 *Simplifying build pipelines* — Tools like Rails’s [import-map](https://github.com/rails/importmap-rails) recommend using a CDN like [jspm](https://jspm.org/) to outsource to build step needed by some npm packages. Personally I find this questionable for security reasons, but some prefer to trade security for convenience.

🔌 *Sidestepping max connections?* — Browsers limit HTTP requests to 6 connections per domain, so having some assets served in a different domain can potentially have some advantages. In practice however, [HTTP/1.1 pipelining](https://en.wikipedia.org/wiki/HTTP_pipelining) and [HTTP/2.0 Multiplexing](https://developers.google.com/web/fundamentals/performance/http2#request_and_response_multiplexing) should already allow browsers to make multiple concurrent requests.

---

## What do we do now?
For production builds, self-hosting seems to be a much better alternative to using CDN’s.

💡 *Self-hosted JavaScript* — There are many options today for self-hosting npm packages.

💅 *Self-hosted fonts* — [Fontsource](https://fontsource.org/) is an easy way to self-host Google Fonts (and more) without having to manually manage font files.

⚡ *Use a CDN* — Not a public CDN, but CDN services like [Cloudflare](https://cloudflare.com) and [Fastly](https://fastly.com) can make pages load fast (<100ms!). This will make self-hosting very viable.

🔌 *Enable HTTP/2* — It’s a great idea to support HTTP/2.0 across all steps in web hosting infrastructure. Cloudflare, for example, allows [enabling HTTP/2 support](https://www.cloudflare.com/website-optimization/http2/) in their cache proxy service. 

---

## Links
- [How to Adapt to Shared Cache Going Away | Section](https://www.section.io/blog/how-to-adapt-to-browser-shared-cache-going-away/)
- [Shared Cache is Going Away](https://www.jefftk.com/p/shared-cache-is-going-away)
- [Shared Cache Is Going Away | Hacker News](https://news.ycombinator.com/item?id=21429621)
- [sirdarckcat: HTTP Cache Cross-Site Leaks](http://sirdarckcat.blogspot.com/2019/03/http-cache-cross-site-leaks.html)