-
-
Notifications
You must be signed in to change notification settings - Fork 2.1k
New issue
Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? # to your account
Add external_js/css_urls
to dash init.
#305
Conversation
I personally love this. One more step towards getting rid of Now, what should the name be? I guess technically it doesn't even need to be "external". And should we say "script" or "js" or "javascript"? The permutations:
cc @plotly/dash as well |
I put |
I like having the word |
dash/dash.py
Outdated
((self.css.append_css, x) | ||
for x in (external_css_urls or []))): | ||
method({'external_url': resource, 'external_only': True}) | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think that we should just add these URLs no matter what. In other words, reserve the serve_locally
argument just for the component CSS where there will always be a local and a remote version. Slowly, I'd like to move ourselves away from the app.scripts.method
interface as well.
Users may want to serve the assets locally because unpkg
is unreliable for them or its blocked for them but load the JS or CSS urls from some other CDN. Or, they might have an internal CDN where they host assets but they can't load external assets from unpkg.
So instead, let's keep this as a private variable or something and then just embed it directly in the _generate_scirpts_html
function:
Lines 312 to 332 in 54ca4a3
# Dash renderer has dependencies like React which need to be rendered | |
# before every other script. However, the dash renderer bundle | |
# itself needs to be rendered after all of the component's | |
# scripts have rendered. | |
# The rest of the scripts can just be loaded after React but before | |
# dash renderer. | |
# pylint: disable=protected-access | |
srcs = self._collect_and_register_resources( | |
self.scripts._resources._filter_resources( | |
dash_renderer._js_dist_dependencies | |
) + | |
self.scripts.get_all_scripts() + | |
self.scripts._resources._filter_resources( | |
dash_renderer._js_dist | |
) | |
) | |
return '\n'.join([ | |
'<script src="{}"></script>'.format(src) | |
for src in srcs | |
]) |
append_script
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ah, nevermind I see that external_only
will embed it no matter what. OK, then that weakens my argument for not using append_script
. I still don't really like the app.scripts...
and app.css...
namespace and I'd like for us to move away from it. However, I guess I don't have strong feelings about whether we should do this incrementally (i.e. not use it in this PR) or remove it all at once in a major version upgrade down the line.
Alright, this looks good to me. I'm curious about your thoughts w.r.t. #305 (comment) but I won't let it block this PR. You're welcome to keep it as is or begin migrating away from 💃 |
I'd like us to move from the css and js resources as I don't really like that system but it works. I hadn't thought about just putting them in |
I have a few comments here:
As an aside, Dash also serves up it's internal resources from unpkg.com and, as this is an untrusted third-party, these should also use SRI. This would mean adjusting the code as in my comment mentioned above and generating hashes automatically on build of |
External scripts/styles are output after the assets. The renderer script is always loaded last.
I thought about it and I opted for a list of string for simplicity of usage, could put a check if it's string or a dict then format the tag accordingly. |
I added support for tags with custom attributes, they can be mixed with simple urls. Also removed Example: app = dash.Dash(external_scripts=[
'https://www.google-analytics.com/analytics.js',
{
'src': 'https://cdnjs.cloudflare.com/ajax/libs/lodash.js/4.17.10/lodash.core.js',
'integrity': 'sha256-Qqd/EfdABZUcAxjOkMi8eGEivtdTkh3b65xCZL4qAQA=',
'crossorigin': 'anonymous'
}
]) With that in place, we could add SRI to the bundles resources on unpkg as @pope1ni suggested in a future PR. |
Doesn't look like this is explained here https://dash.plot.ly/external-resources |
Solution for #302.
Add two keywords arguments to
Dash.__init__
:external_scripts_urls
to include javascript files.external_css_urls
to include stylesheets.They are both list of urls: