Aspnetcore.docs: Possible to simplify SignalR client library instructions

[manukautech]

"Add the SignalR client library" instructions in this tutorial need to be simpler. I downloaded one file "signalr.min.js" from the SignalR samples sub-folder on Github and pasted that under "wwwroot". Simple copy and paste works well. No need for the drama of node.js and npm.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 0dd2991d-c22d-ad0f-80b6-bd1b503db8f3
• Version Independent ID: 5e3fbe1d-c97f-9940-4f0c-067d4b2112b1
• Content: Tutorial: Get started with SignalR on ASP.NET Core
• Content Source: aspnetcore/tutorials/signalr.md
• Product: aspnet-core
• GitHub Login: @tdykstra
• Microsoft Alias: tdykstra

[Rick-Anderson]

@BrennanConroy or @anurse please review.

[BrennanConroy]

I don't think there is anything to do here. Copying a random "signalr.min.js" file is definitely not the recommended way to get the javascript client.

[Rick-Anderson]

Do you have any plans in the future to add signalr.min.js, signalr.js to the templates?

[davidfowl]

We can mention the cdn way to get signalr:

• https://unpkg.com/@aspnet/signalr@1.0.2/dist/browser/signalr.min.js
• https://cdn.jsdelivr.net/npm/@aspnet/signalr/dist/browser/signalr.min.js

[scottaddie]

I like @davidfowl's suggestion. If using VS, LibMan is a simple way to do this (as of VS 2017 15.8). If not using VS, the LibMan CLI can be used. Some of the supporting LibMan docs are being published this week.

[davidfowl]

Can we show a pure CDN usage as well?

[tdykstra]

The general rule for tutorials is to show just one way to do things. The CDN way would be simpler and probably the better choice for this tutorial. @scottaddie How about I relegate LibMan to Next steps and redo this to use CDN directly?

[anurse]

I'm very much in favor of using CDN instead of LibMan. If npm is too much ceremony, I think LibMan would also be too complicated for the same reasons (and it's much less commonly known).

[anurse]

We should use Subresource Integrity as it is a highly recommended pattern when using CDNs to protect against CDN hijacking.

We'd use a reference like this:

<script src="https://unpkg.com/@aspnet/[email protected]/dist/browser/signalr.min.js" integrity="sha384-T1M/vJFz1G/wS//QkHGRmFPa7P60cK2jnHihXkdaa3Uxip28viR0Xw+A4LHYOc+9" crossorigin="anonymous"></script>

When we want to update the version we'd need to update both the version number (easy but tedious) and the SRI hash (also easy, using https://www.srihash.org/, but still tedious).

[tdykstra]

How often would the file change significantly enough that we would need to change the reference?

[anurse]

Every patch would trigger this change since we embed version numbers in the JS file. That assumes that we feel the need to change this doc with every patch. I'm not sure the right approach here though. The original reason for choosing NPM here was that it was the standard front-end package management system. If that has changed to LibMan I guess I'm fine with using that, though I don't think it has... I'd like the docs to be as simple as possible but it's very important that we avoid bad practices. I would strongly advise against using the CDN directly without using Subresource Integrity, so we end up with something a little more complicated than a simple <script> tag no matter what we do.

[scottaddie]

@justcla is working to add LibMan to the project templates. There's already a PR for it here: https://github.com/aspnet/Templating/pull/679. For this reason, I recommended LibMan. I'd be okay with the raw CDN approach too, especially if @davidfowl and @anurse feel strongly about it. That might actually make the most sense until LibMan is added to the project templates.