proposal-import-attributes

Wow that’s pretty neat. Because of that I also learned about import attributes (https://github.com/tc39/proposal-import-attributes) which is probably going to be quite useful and make the 50 lines of imports in some of my files look even dumber.

Things like HTML (and JSON) imports in ES modules, among other things, have been waiting on some safety signalling mechanics currently named "Import Attributes". Import Attributes are currently in Stage 3 [0]. The basic security story is that browsers never care about file extensions, they care about MIME types. A developer might add an import to a third-party HTML or JSON file somewhere and expect one "safe" behavior, but the third-party could just return a MIME type of "text/javascript" and inject an entire script and the browser is supposed to respect that MIME type. To keep things safe, browsers want a way to signal that an import is supposed to JSON (or HTML or CSS) rather than JS and error if it gets back something "wrong" from a server request. That's one of the proposed uses for Import Attributes to suggest expected MIME types for

This could be implemented as an import assertion[1]: import foo from 'http://example.com/foo' assert { sha256sum: '...' } This feature would even be useful in the web platform in general. Would also be nice to see an assertion for importing plain text files (not just JSON files) and assertions for per-module Deno permissions. [1]: https://github.com/tc39/proposal-import-assertions

There's an issue for that to be added as part of import assertions https://github.com/tc39/proposal-import-assertions/issues/11...

> Is this supported by browsers or is it a NodeJS extension? This is a node extension. It is coming to browsers in form of import assertions. See https://github.com/tc39/proposal-import-assertions