r/javascript 4d ago

Subreddit Stats Your /r/javascript recap for the week of August 24 - August 30, 2026

4 Upvotes

Monday, August 24 - Sunday, August 30, 2026

Top Posts

score comments title & link
71 27 comments Have you seen the new browser Email Verification API?
70 17 comments Reducing Zod's memory footprint by an order of magnitude with memoizing prototypes
56 7 comments Learning music theory through JavaScript, with runnable Web Audio examples
31 11 comments Open-Source Gwent classic (The Witcher 3) Web & APK!
23 11 comments [AskJS] [AskJS] referring to parent or grandparent class instance properties
17 6 comments Telixon - phone number library that compiles Google's libphonenumber metadata into a DFA (10x faster, 26 kB)
16 4 comments Caravan, a flexible TypeScript-first logger for JavaScript applications
9 6 comments Browser Test: A browser-based automated javascript testing framework in one .html file
9 5 comments Lightweight, native HTTP client built in C++20 — a fast, local-first alternative to Postman and Insomnia.
9 0 comments Modernising Project GoldScript for 2026

 

Most Commented Posts

score comments title & link
0 42 comments [AskJS] [AskJS] How common is the term "Barrel" and do you know what it means?
0 21 comments [AskJS] [AskJS] How securely can we store a private key in the browser? (details inside)
7 16 comments [AskJS] [AskJS] Which UI component library or DataGrid solution do you use for your web projects?
0 11 comments How to drive your frontend from the backend
3 8 comments [AskJS] [AskJS] Good References for JS Design Patterns?

 

Top Ask JS

score comments title & link
6 1 comments [AskJS] [AskJS] Where should attribution logic stop in a JavaScript app?
4 1 comments [AskJS] [AskJS] Building an in-browser APK compiler — binary XML streams and signature blocks in client-side JS
0 5 comments [AskJS] [AskJS] Our server boot got slower and the commit history had no answer, so I timed every require

 

Top Showoffs

score comment
3 /u/moving808s said https://reddit.com/link/p6kgv92/video/lzmn08lom9mh1/player This week I upgraded from animejs v2 to v4 to plug my game clock in for deterministic dom animations. If you wanna read more about my pro...
2 /u/anonahnah9 said I made a multiplayer boxing game in the browser 🥊 The fights are drawn with JavaScript on a Canvas 2D context. There’s a requestAnimationFrame loop handling the animation and rendering, while the act...
2 /u/ScoobyDookuu said Hey y’all, I got slightly carried away with loading animations. I wanted nicer loading states for my own projects, but most libraries I found were either tied to a framework, fairly limited, or requ...

 

Top Comments

score comment
44 /u/blood_bender said Barrel file is just an `index.js/ts` that imports and reexports a ton of other functions/classes/constants, usually part of a root library directory so other parts of the app don't have to imp...
18 /u/monotone2k said This feels like an [XY problem](https://xyproblem.info/). What are you actually trying to build?
16 /u/Ecksters said Interesting, TanStack Table [recently did the same optimization](https://tanstack.com/blog/tanstack-table-v9-memory-performance) from what I can tell. Are there cases for Zod where no...
12 /u/imvictorious said Great idea. I don't think this is going to work with my catch all email address which I use though or am I wrong?
12 /u/thecementmixer said Is there an RFC for this or is this just wishful thinking?

 


r/javascript 12h ago

Can AI agents run purely in the browser with vanilla JS? Exploring $0 hosting & zero data egress

Thumbnail github.com
0 Upvotes

AI agents assume a server-side Python chain framework runtime and containers. Running client-side with JavaScript allows pushing agents entirely inside the browser, meaning $0 hosting infrastructure and zero data leaving the client.

Running client-side, you can use agents directly with WebLLM (for fully in-browser) or point them at a local Ollama / vLLM instance for 100% offline usage.

Breakdown In-Browser Loop

An in-browser agent relies on a continuous asynchronous loop that manages state, updates the DOM or application state, and invokes tools based on model outputs. Here is a minimal, clean implementation of a client-side agent loop using WebLLM's engine.chat.completions API:

```javascript import { CreateMLCEngine } from "@mlc-ai/web-llm";

async function agentLoop(task, context = {}) { const engine = await CreateMLCEngine("gemma-4-instruct"); let messages = [{ role: 'user', content: task }]; let running = true;

while (running) { const response = await engine.chat.completions.create({ messages, tools: availableTools }); const choice = response.choices[0].message;

if (choice.tool_calls) {
  for (const call of choice.tool_calls) {
    const toolResult = await executeTool(call.function.name, call.function.arguments);
    messages.push({ role: 'tool', tool_call_id: call.id, content: toolResult });
  }
} else {
  running = false;
  return choice.content;
}

} } ```


r/javascript 14h ago

AskJS [AskJS] BeeLadybug — Open Source Canvas 2D Debug Overlay in Vanilla JS (Zero Dependencies)

0 Upvotes

I built BeeLadybug, a zero-dependency visual debugging overlay for my Vanilla JS Canvas engine. It renders AABB hitboxes in world space (green for clear, red for collisions) and a screen-space HUD with FPS, active entities, cycle time, and freeze-frame / slow-motion controls (F2/F3/F4). Here is the clean source code:

export const BEE_LADYBUG_DEFAULTS = Object.freeze({
    toggleKey: 'F2',
    slowKey: 'F3',
    freezeKey: 'F4',
    slowScale: 0.25,
    colorActive: '#3dff6a',
    colorColliding: '#ff3b3b',
    colorInactive: '#8a8a8a',
    overlayX: 12,
    overlayY: 12
});


export class BeeLadybug {
   
    constructor(engine, options = {}) {
        this.engine = engine;
        this.configure(options);


        this.enabled = false;
        this.#entities = [];
        this.#colliding = new Set();
        this.#buttons = [];
        this.#onKeyDown = (event) => this.#handleKey(event);
        this.#bound = false;
    }


    #entities;
    #colliding;
    #buttons;
    #onKeyDown;
    #bound;


    configure(options = {}) {
        const cfg = { ...BEE_LADYBUG_DEFAULTS, ...options };
        this.toggleKey = cfg.toggleKey;
        this.slowKey = cfg.slowKey;
        this.freezeKey = cfg.freezeKey;
        this.slowScale = cfg.slowScale;
        this.colorActive = cfg.colorActive;
        this.colorColliding = cfg.colorColliding;
        this.colorInactive = cfg.colorInactive;
        this.overlayX = cfg.overlayX;
        this.overlayY = cfg.overlayY;
        return this;
    }


    attach() {
        if (this.#bound) return this;
        window.addEventListener('keydown', this.#onKeyDown);
        this.#bound = true;
        return this;
    }


    detach() {
        if (!this.#bound) return this;
        window.removeEventListener('keydown', this.#onKeyDown);
        this.#bound = false;
        return this;
    }


    destroy() {
        this.detach();
        this.enabled = false;
        this.#entities.length = 0;
        this.#colliding.clear();
        this.#buttons.length = 0;
    }


    show() {
        this.enabled = true;
        return this;
    }


    hide() {
        this.enabled = false;
        return this;
    }


    toggle() {
        this.enabled = !this.enabled;
        return this;
    }


    applySlowMo() {
        const time = this.engine.time;
        if (!time) return this;
        if (time.paused) time.resume();
        const next = time.timeScale === this.slowScale ? 1 : this.slowScale;
        this.engine.setTimeScale(next);
        return this;
    }


    toggleFreeze() {
        const time = this.engine.time;
        if (!time) return this;
        time.togglePause();
        return this;
    }


    restoreRealtime() {
        const time = this.engine.time;
        if (!time) return this;
        if (time.paused) time.resume();
        this.engine.setTimeScale(1);
        return this;
    }


    #handleKey(event) {
        if (event.repeat) return;


        if (event.code === this.toggleKey) {
            event.preventDefault();
            this.toggle();
            return;
        }


        if (!this.enabled) return;


        if (event.code === this.slowKey) {
            event.preventDefault();
            this.applySlowMo();
            return;
        }


        if (event.code === this.freezeKey) {
            event.preventDefault();
            this.toggleFreeze();
        }
    }


    #collectEntities() {
        const list = this.#entities;
        list.length = 0;
        const seen = new Set();


        const visit = (entity) => {
            if (!entity || entity.destroyed || seen.has(entity)) return;
            seen.add(entity);
            list.push(entity);
            const kids = entity.children;
            if (!kids) return;
            for (let i = 0; i < kids.length; i++) {
                visit(kids[i]);
            }
        };


        const engine = this.engine;
        const roots = engine.entities;
        if (roots) {
            for (let i = 0; i < roots.length; i++) visit(roots[i]);
        }


        const scene = engine.scenes && engine.scenes.currentScene
            ? engine.scenes.currentScene
            : engine.currentScene;
        if (scene && scene.entities) {
            for (let i = 0; i < scene.entities.length; i++) visit(scene.entities[i]);
        }


        const groups = engine.collisions && engine.collisions.groups;
        if (groups && typeof groups.values === 'function') {
            for (const bucket of groups.values()) {
                if (!bucket) continue;
                for (let i = 0; i < bucket.length; i++) visit(bucket[i]);
            }
        }


        return list;
    }


    #aabbOf(entity) {
        const engine = this.engine;
        if (engine && typeof engine.getEntityDrawBounds === 'function') {
            return engine.getEntityDrawBounds(entity);
        }
        if (!entity) return null;
        return {
            x: typeof entity.worldX === 'number' ? entity.worldX : entity.x,
            y: typeof entity.worldY === 'number' ? entity.worldY : entity.y,
            width: entity.width ?? 0,
            height: entity.height ?? 0
        };
    }


    #refreshCollisions(list) {
        const colliding = this.#colliding;
        colliding.clear();


        const boxes = [];
        for (let i = 0; i < list.length; i++) {
            const bounds = this.#aabbOf(list[i]);
            if (!bounds || bounds.width <= 0 || bounds.height <= 0) {
                boxes.push(null);
                continue;
            }
            boxes.push(bounds);
        }


        for (let i = 0; i < list.length; i++) {
            const a = boxes[i];
            if (!a) continue;
            for (let j = i + 1; j < list.length; j++) {
                const b = boxes[j];
                if (!b) continue;
                if (
                    a.x < b.x + b.width &&
                    a.x + a.width > b.x &&
                    a.y < b.y + b.height &&
                    a.y + a.height > b.y
                ) {
                    colliding.add(list[i]);
                    colliding.add(list[j]);
                }
            }
        }
    }


    
    drawWorld(ctx) {
        if (!this.enabled) return;


        const list = this.#collectEntities();
        this.#refreshCollisions(list);


        ctx.save();
        ctx.lineWidth = 1.5;


        for (let i = 0; i < list.length; i++) {
            const entity = list[i];
            const box = this.#aabbOf(entity);
            if (!box || box.width <= 0 || box.height <= 0) continue;


            const colliding = this.#colliding.has(entity);
            const active = entity.active !== false;
            const color = colliding
                ? this.colorColliding
                : (active ? this.colorActive : this.colorInactive);


            ctx.strokeStyle = color;
            ctx.fillStyle = colliding ? 'rgba(255, 59, 59, 0.16)' : 'rgba(61, 255, 106, 0.08)';
            ctx.fillRect(box.x, box.y, box.width, box.height);
            ctx.strokeRect(box.x + 0.5, box.y + 0.5, box.width, box.height);
        }


        ctx.restore();
    }


    
    drawOverlay(ctx) {
        if (!this.enabled) return;


        const engine = this.engine;
        const time = engine.time;
        const list = this.#entities;
        let activeCount = 0;
        for (let i = 0; i < list.length; i++) {
            if (list[i].active !== false) activeCount += 1;
        }


        const fps = time ? time.fps : 0;
        const cycleMs = time ? time.unscaledDt * 1000 : 0;
        const scale = time ? time.timeScale : 1;
        const frozen = time ? time.paused : false;


        const x = this.overlayX;
        const y = this.overlayY;
        const width = 268;
        const height = 168;


        ctx.save();
        ctx.setTransform(1, 0, 0, 1, 0, 0);


        ctx.fillStyle = 'rgba(10, 12, 18, 0.82)';
        ctx.strokeStyle = '#ff4d4d';
        ctx.lineWidth = 2;
        if (typeof ctx.roundRect === 'function') {
            ctx.beginPath();
            ctx.roundRect(x, y, width, height, 8);
            ctx.fill();
            ctx.stroke();
        } else {
            ctx.fillRect(x, y, width, height);
            ctx.strokeRect(x, y, width, height);
        }


        ctx.fillStyle = '#ff4d4d';
        ctx.beginPath();
        ctx.arc(x + 22, y + 22, 9, 0, Math.PI * 2);
        ctx.fill();
        ctx.fillStyle = '#1a1a1a';
        ctx.beginPath();
        ctx.arc(x + 19, y + 20, 2, 0, Math.PI * 2);
        ctx.arc(x + 25, y + 20, 2, 0, Math.PI * 2);
        ctx.fill();


        ctx.fillStyle = '#ffe08a';
        ctx.font = 'bold 14px monospace';
        ctx.textAlign = 'left';
        ctx.textBaseline = 'top';
        ctx.fillText('BeeLadybug', x + 38, y + 14);


        ctx.fillStyle = '#d8d8d8';
        ctx.font = '12px monospace';
        const lines = [
            `FPS      ${fps.toFixed(0)}`,
            `ENTITA   ${activeCount} attive / ${list.length} in memoria`,
            `CICLO    ${cycleMs.toFixed(2)} ms`,
            `SCALE    ${scale.toFixed(2)}x   SIM ${frozen ? 'FREEZE' : 'RUN'}`
        ];
        for (let i = 0; i < lines.length; i++) {
            ctx.fillText(lines[i], x + 14, y + 42 + i * 16);
        }


        this.#buttons = [
            { id: 'slow', label: 'F3 SLOW', x: x + 12, y: y + 114, w: 78, h: 22 },
            { id: 'freeze', label: 'F4 STOP', x: x + 96, y: y + 114, w: 78, h: 22 },
            { id: 'live', label: '1x LIVE', x: x + 180, y: y + 114, w: 74, h: 22 }
        ];


        for (let i = 0; i < this.#buttons.length; i++) {
            const btn = this.#buttons[i];
            const hot = (btn.id === 'slow' && scale !== 1 && !frozen)
                || (btn.id === 'freeze' && frozen)
                || (btn.id === 'live' && scale === 1 && !frozen);
            ctx.fillStyle = hot ? '#ff4d4d' : '#2a2f3a';
            ctx.fillRect(btn.x, btn.y, btn.w, btn.h);
            ctx.strokeStyle = '#ffe08a';
            ctx.strokeRect(btn.x + 0.5, btn.y + 0.5, btn.w, btn.h);
            ctx.fillStyle = '#fff6d8';
            ctx.font = 'bold 10px monospace';
            ctx.textAlign = 'center';
            ctx.textBaseline = 'middle';
            ctx.fillText(btn.label, btn.x + btn.w / 2, btn.y + btn.h / 2);
        }


        ctx.textAlign = 'left';
        ctx.textBaseline = 'top';
        ctx.fillStyle = '#9aa0aa';
        ctx.font = '10px monospace';
        ctx.fillText('F2 mostra/nasconde   verde=ok  rosso=collide', x + 12, y + 146);


        ctx.restore();
    }


   
    poll() {
        if (!this.enabled) return;


        const input = this.engine.input;
        if (!input || !input.mouse || !input.mouse.wasPressed) return;


        const mx = input.mouse.x;
        const my = input.mouse.y;
        for (let i = 0; i < this.#buttons.length; i++) {
            const btn = this.#buttons[i];
            if (mx < btn.x || mx > btn.x + btn.w || my < btn.y || my > btn.y + btn.h) continue;
            if (btn.id === 'slow') this.applySlowMo();
            else if (btn.id === 'freeze') this.toggleFreeze();
            else if (btn.id === 'live') this.restoreRealtime();
            break;
        }
    }
}

r/javascript 16h ago

Headless phone input controller with no baked-in UI to fight

Thumbnail github.com
4 Upvotes

Have you ever been on a project with a polished UI library, animated inputs, a specific look, and then had to add a phone number field? A phone input is not just validation. Under the hood it is real work: formatting the number as you type, keeping the caret in place, and handling events like paste and undo. The ready-made widgets handle that, but each ships its own markup and styling. Matching one to a specific, opinionated design system does not always work.

That is exactly why I built a headless input controller. You pass your styled input into a function, whatever it looks like, and it handles the rest: formatting, validation, the input events, and the caret.

```js import { createPhoneInput } from '@telixon/web-sdk';

const phone = createPhoneInput({ mode: 'international', defaultRegion: 'US', display: { callingCodeInInput: true, plusPrefix: 'erasable' }, input: document.querySelector('input'), });

phone.subscribe((state) => { // state.value, state.region, state.validationError (a typed reason) }); ```

That one call covers the actions people actually do: paste (formatted numbers too, and it dedupes a repeated country code), drag/drop, cut, word/line delete, IME, autofill, and undo/redo. On every keystroke the state carries the fully parsed, validated number, with a typed reason when it is not valid: too short by N, a calling code that cannot exist, and so on.

Under it is a headless controller you can drive directly, with no DOM: insert, deleteBackward, deleteForward, setValue, undo, redo, region/type filters, getPhoneNumber. One controller does national, international with the calling code in or out of the field, and your own country picker. Formatting and validation come from Google's libphonenumber metadata.

Playground to try it live: telixon.dev/playground/input


r/javascript 18h ago

GitHub - unadlib/localspace: A library that unifies the APIs of IndexedDB, localStorage and other storage into a consistent API

Thumbnail github.com
3 Upvotes

r/javascript 20h ago

AskJS [AskJS] Best way to handle rotating proxies in Node.js?

1 Upvotes

I've got a Node.js script making a decent number of requests and I'm trying to decide where proxy rotation should live. One option is picking a new proxy inside the app, the other is using one endpoint and letting the proxy service rotate behind it. The second sounds cleaner, but I'm not sure how well that works when you need sticky sessions. How are you structuring this in your own projects?


r/javascript 21h ago

Zustand is now the top state management library in new JS repos, and it's still accelerating (+7.3% this week). Pulled this from a dataset of 5,000+ live repos.

Thumbnail github.com
0 Upvotes

r/javascript 21h ago

I made a WebGL 2D renderer for browser games that keeps pace with PixiJS in my benchmarks

Thumbnail github.com
2 Upvotes

hi! I recently developed Rapid.js, an open-source, zero-dependency WebGL 2D renderer built specifically for browser games.

It provides an immediate-mode API and does not retain game objects or a scene graph between frames. This leaves developers free to structure their games using OOP, ECS, or any custom architecture—Rapid.js is responsible only for rendering the drawing commands submitted each frame.

It supports sprites, particles, masks, shaders, render textures, and multi-texture batching, and its UMD build is only approximately 20.6 kB gzipped.

Its small size does not come at the expense of performance: in the included browser benchmark, Rapid.js performs comparably to PixiJS.

benchmark:

https://github.com/Nightre/Rapid.js/raw/main/docs/benchmark/benchmark.png

benchmark live:

https://nightre.github.io/Rapid.js/benchmark/


r/javascript 1d ago

What "import defer" Actually Changes About Module Loading

Thumbnail truongphan.com
0 Upvotes

r/javascript 1d ago

I made a GitHub Action that lets you find and replace text… with JS!

Thumbnail github.com
0 Upvotes

r/javascript 1d ago

A breakdown of errors found in the TypeScript code of VS code

Thumbnail pvs-studio.com
0 Upvotes

r/javascript 1d ago

WASI 0.3 Launched

Thumbnail bytecodealliance.org
15 Upvotes

r/javascript 2d ago

A free and open source service to get a name.runs-on.dev subdomain for students and builders

Thumbnail runs-on.dev
7 Upvotes

Rebooted a sick project i found use for when i was starting out!


r/javascript 2d ago

Wasmer SDK: Open Source alternative to WebContainers

Thumbnail wasmer.io
24 Upvotes

r/javascript 2d ago

10 checks and tools for frontend projects with AI code going faster than humans can review

Thumbnail evilmartians.com
0 Upvotes

r/javascript 3d ago

RDR2-style volumetric WebGL 2 clouds in the browser

Thumbnail codepen.io
28 Upvotes

I've been working with clouds in the browser for a couple years now, and these are the best I've made so far. I've tried noise, particles, voxels, etc. and every combination of the options. Each approach has its upsides and downsides.


r/javascript 3d ago

AskJS [AskJS] I'm thinking of creating a JS dialect for scientists

0 Upvotes

What do you think of the ~> operator? It is be similar to |>, but it operates over lists.

js let v = [1, 2, 3] // this is a vector let w = v ~> it * 2 // equiv. to `v.map(it => it * 2)` let w = v *> 2 // shorthand for `v ~> it * 2`

The dialect would be primarily aimed at statesmen and scientists.


r/javascript 3d ago

Node.js sandboxes powered by QuickJS and WebAssembly

Thumbnail wasmer.io
18 Upvotes

r/javascript 3d ago

AskJS [AskJS] AI is destroying JavaScript

0 Upvotes

I think we have to start facing the facts. JavaScript used to be the dominant programming language for software engineering back in the days of React and Express. Now it’s a graveyard, and Python is honestly starting to threaten Node.js. Look at where Python is going since like 3.10. It’s starting to appeal to the next generation of software developers.

Now look at JavaScript. Every company is an AI company. Most libraries are AI libraries. As if AI is going to save us all. Nowadays it’s nothing compared to what JavaScript used to be.

I think we should honestly just ditch AI. AI is this heartless and soulless machine that doesn’t really care about code quality or style. It just regurgitates code for whatever prompt that some vibe coder who isn’t even a software engineer is feeding it. I know there’s a whole class of JavaScripters who despise AI for just that reason.

We should just get back to the basics. I think ES Modules is pretty cool and unexplored front-end territory. Node.js is still leading but it really does seem that Python is shifting towards the functional side so that’s something to worry about.

Yes I wrote Rubico. I was on here a while back just plugging my articles and my library. I’m using it at Claimyr and CLOUT so that’s how I’m keeping it alive. Now I’m honestly just fighting AI. AI data centers are straight up killing people. They’re using fresh water that people need to live to cool the servers, like 5 million gallons per day, which is equivalent to the amount of water used by a town populated by 10,000 - 50,000 people.

My question is why? Why are AI data centers so oblivious to the environmental destruction that they are causing? Why can’t AI data centers find some other solution?


r/javascript 4d ago

Anyone interested in Git for your test database? useful for assisting QA doing a test.

Thumbnail github.com
10 Upvotes

r/javascript 4d ago

AskJS [AskJS] Our server boot got slower and the commit history had no answer, so I timed every require

0 Upvotes

Our API server was slow to start and nobody could say when that began. Not slow under load, slow before the first request, visible only because the deploy health check timed out on smaller instances. Nothing in the commit history looked like a boot cost. I had no instrument, so I wrote a bad one, eleven lines in a preload file that wrap Module._load, time each call with process.hrtime.bigint(), and print anything over fifty milliseconds along with the module that asked for it.

The first run was blunt. Cold boot averaged 1.9 seconds. One require accounted for 1.1 of that, and it was ours, src/lib/index.js, a barrel that one route imports for a single date helper. Importing it pulls in all thirty four modules in that directory, two of which read config files at import time. Removing a barrel rewrites every import path that went through it, so the code review subagent in verdent read the diff before I opened the PR. Deleting the barrel and importing the helper directly put cold boot at 0.8 seconds.

Patching Module._load to learn this still feels wrong. Is there a way to get the same per module breakdown out of something the runtime already reports?


r/javascript 4d ago

Object.hasOwn() vs hasOwnProperty() vs in — The JS Property Check Showdown

Thumbnail truongphan.com
0 Upvotes

Understand the difference between Object.hasOwn(), hasOwnProperty(), and the in operator in JavaScript. Includes edge cases, performance notes, and a polyfill for older environments.


r/javascript 4d ago

Let's go another framework! A fast little framework for server-first React apps, fully compatible with Next.js.

Thumbnail pnext.dev
5 Upvotes

Hey guys, happy to finally release this. So it is two parts.

  • Core pnext is small and fast: the same next.js api with no/minimal framework overhead and no backward-compat burden. Based on Bun and Preact, 0 KB on server-rendered pages, 7.5 KB client pages runtime, roughly 10x faster first page render in dev and 7-9x faster production builds than next.js (best effort fixtures).
  • Compat mode runs your existing Next.js app unchanged (App Router only). About 4.4k assertions from Next's own test suite passing, adding more day by day.

The core motivation was a super fast dev server that doesn't hog memory, and instant builds. The goal is to optimize every step down to absolute values, and of course agentic flows are helping a lot! Check out Coder.

Give it a try and let me know what you think, and how your Next.js apps break in compat mode (improving, haha)!

https://pnext.dev


r/javascript 4d ago

AskJS [AskJS] Good References for JS Design Patterns?

4 Upvotes

Hey everyone 👋

I'm primarily a backend dev that has found myself in a position where I am writing more JavaScript than I ever have. I'm looking for a book or reference analogous to the "big four" design patterns book for C++, but updated for modern JavaScript design patterns/idioms.

Im primarily looking for references in vanilla javascript. Not Typescript or any js frameworks. My thinking is the knowledge should easily transfer over anyway. I'm looking to build a stronger foundation with the language itself.

Any good reference material would be appreciated!

Edit: I should add, I primarily work in the .NET ecosystem, so I don't do js on the backend much.


r/javascript 4d ago

AskJS [AskJS] How securely can we store a private key in the browser? (details inside)

0 Upvotes

I'm working on a personal end-to-end encrypted chat app project and running into a sort of secure storage paradox trying to find a key store that's secure at runtime is unsecured at rest, and using the one that's secured at rest is unsecured at runtime:

- localStorage/indexeddb are just plaintext data in not encrypted at rest on disk
- you can encrypt string data to put into localStorage, but if that data is a private key, it's accessible to anything in your app (could be exfiltrated)
- you can make webCrypto CryptoKeyPair objects non-extractable and store the whole object in indexedDB, but you cannot encrypt it b/c it's not a string, and you can't use key wrapping (like with passphrase based AES256) on non-extractable keys so that they're secured at rest b/c wrapping requires an extraction operation...

Is there a reasonable fix to this? It seems increasingly nuts if/that browsers aren't encrypting the whole SQLite store / all of the SQLite stores (just bits and pieces they use internally), and so data stored in localStorage/indexedDB, while restricted by origin at runtime, are completely unsecured at rest...

Please tell me I'm missing something. Is there any way to store a key so it's both only usable locally (not portable) AND is secure* at rest

*secure enough... I know nothing is ever completely secure, this just seems like a wider than average gap.

(glossing over some details here for succinctness) the best I can come up with is using 2 sets of PGP keys and storing one pair/private key in a non-exportable webCryptoCryptoKeyPairobject in indexedDb, and the other pair/private in localstorage encrypted with passphrase based AES256... so that only half the equation is stored in a runtime "exportable" way and only half is stored un-encrypted at rest... and making sure both are required to decrypt the any given message... but that also seems excessive. I know "don't roll your own crypto", but I can't see any other way even a library would overcome this seeming secure storage paradox with existing browser APIs