Add an option to remove devtools from production

[tiziodcaio]

Related plugins

• plugin-react

• plugin-react-swc

Description

React developer tool works also in production by default...
It might be a security hole!

Suggested solution

Might the vite plugin inject this code on index.html as said in this thread?

<script>
window.__REACT_DEVTOOLS_GLOBAL_HOOK__&& 
(window.__REACT_DEVTOOLS_GLOBAL_HOOK__.inject=function(){})
</script>

Alternative

We can inject manually the script tag in our main.html file:

<script>
window.__REACT_DEVTOOLS_GLOBAL_HOOK__&& 
(window.__REACT_DEVTOOLS_GLOBAL_HOOK__.inject=function(){})
</script>

A good idea might be documenting it.

Additional context

No response

Validations

• Follow our Code of Conduct
• Read the Contributing Guidelines.
• Read the docs.
• Check that there isn't already an issue that request the same feature to avoid creating a duplicate.

[sapphi-red]

I wasn't able to reproduce it. It does not have __REACT_DEVTOOLS_GLOBAL_HOOK__ defined.
https://stackblitz.com/edit/vitejs-vite-fcdfrwn8?file=index.html&terminal=build
I don't think it's enabled by plugin-react / plugin-react-swc or Vite core.

[tiziodcaio]

Try this on a new tab!

with the tag

without the tag

[tiziodcaio]

npm vite build && npm vite preview to run on production

[sapphi-red]

So it seems setting __REACT_DEVTOOLS_GLOBAL_HOOK__: { isDisabled: true } is the expected way.
facebook/react#3877, facebook/react-devtools#191

This just hides it and isn't a security hole though. Users can easily bypass it.

You can use a config like this to achieve it.

import { defineConfig } from 'vite';
import react from '@vitejs/plugin-react';

export default defineConfig(({ command }) => ({
  plugins: [react()],
  define:
    command === 'build'
      ? {
          __REACT_DEVTOOLS_GLOBAL_HOOK__: { isDisabled: true },
        }
      : {},
}));

[ArnaudBarre]

That's quite a useful feature. There is not security hole at all. It's enabled on facebook so I don't think we should do something for that

[ArnaudBarre]

I'm going to close as not planned. This seems quite a niche need and is quite easy to do already as @sapphi-red showed.