JSRehab: Weaning Common Web Interface Components from JavaScript Addiction

Romain Fouquet (1, 2) , Pierre Laperdrix (3, 1, 2) , Romain Rouvoy (1, 2)

1 Université de Lille
2 SPIRALS - Self-adaptation for distributed services and large software systems
3 CNRS - Centre National de la Recherche Scientifique

Leveraging JavaScript (JS) for User Interface (UI) interactivity has been the norm on the web for many years. Yet, using JS increases bandwidth and battery consumption as scripts need to be downloaded and processed by the browser. Plus, client-side JS may expose visitors to security vulnerabilities such as Cross-Site Scripting (XSS). This paper introduces a new server-side plugin, called JSRehab, that automatically rewrites common web interface components by alternatives that do not require any JavaScript (JS). The main objective of JSRehab is to drastically reduce-and ultimately remove-the inclusion of JS in a web page to improve its responsiveness and consume less resources. We report on our implementation of JS-Rehab for Bootstrap, the most popular UI framework by far, and evaluate it on a corpus of 100 webpages. We show through manual validation that it is indeed possible to lower the dependencies of pages on JS while keeping intact its interactivity and accessibility. We observe that JSRehab brings energy savings of at least 5 % for the majority of web pages on the tested devices, while introducing a median on-the-wire overhead of only 5 % to the HTML payload.

Mots clés: web security; web framework; javascript; content security policy; web accessibility; mobile web; energy savings

Domaines: Web; Cryptographie et sécurité [cs.CR]

Romain Fouquet, Pierre Laperdrix, Romain Rouvoy. JSRehab: Weaning Common Web Interface Components from JavaScript Addiction. WWW '22: Companion Proceedings of the Web Conference 2022, May 2022, Lyon, France. ⟨10.1145/3487553.3524227⟩. ⟨hal-03604674⟩