support for zxcvbn-async

[apertureless]

support for zxcvbn-async

[apertureless]

Hey @mavrick,

I've took a loot at zxcvbn-async. However I have to say I am not a fan of it.
Right now zxcvbn is a peerDependency. So it is not included into the vue-password package. You have to install it into your app as a dependency.

This however gives you the possibility to to chunk it if you add it to your webpack config as a vendor package.

zxcvbn-async will load it over a CDN, which is nice but you have zero control over the versioning, which version of zxcvbn is used and more important it is a security risk. Because you have no control over the CDN path. So in the worst case scenario an update of zxcvbn-async could point to a malicious script which then gets injected into your site.

If you want to optimize your bundle I would suggest that you use code splitting for the password component

const Password = () => import('vue-password-strength-meter')

export default {
	components: { Password }
}

So it will not end up in your main bundle.

[mavrick]

That's fair enough, my concern is my main app bundle excluding zxcvbn is only 500kb gzipped.

i'm using zxcvbn again on the backend to enforce weak password checking. i'm using nuxt so the bundle is being prefetched after page load (which isn't a huge issue) but zxcvbn is almost the same size of my application so I'm just trying to keep it as lean as possible :)

[apertureless]

Maybe something like https://github.com/van-nguyen/webpack-cdn-plugin or https://github.com/mastilver/dynamic-cdn-webpack-plugin could help you.
There are some ways to use CDN sources inside webpack.

And as zxcvbn is only a peerDependency you could possibly load it from a cdn with the right config.