4

I have a lot of experience with YUI2 and I'm getting up to speed on YUI3. The service I'm writing needs HTTPS, but the vanilla YUI experience loads from Yahoo's HTTP-only CDN, which quietly fails in Chrome and loudly fails in modern IE when the browser tries to mix an HTTPS page with HTTP javascript.

My goals are to get all of:

  1. Site uses HTTPS
  2. YUI works in Chrome & IE (so scripts also must be delivered over SSL)
  3. Uses a modern version of YUI 3 (this disqualifies YUI PHP Loader which hasn't been updated to support even YUI 3.4, while 3.8 is "current")
  4. Use roll up combos for speed instead of many JS and CSS files (this disqualifies Google's CDN... if YUI 3 is actually hosted there which I couldn't find.)
  5. Site dynamically loads YUI dependencies (dependencies change regularly as I add functionality, going back to the configurator and saving a new bundle every time is a PITA)

The obvious solution appears to be to give up goal #5 and just self-host combos.

How can I meet all 5 goals?

Jeremy Wadhams
  • 1,744
  • 18
  • 26
  • This sounds like a "requirement" that _everything_ go over HTTPS. Why would you load a publicly available javascript library over a secure connection? Get a local copy if you're paranoid about the source of the library. – Steve H. Jan 31 '13 at 03:10
  • It's actually not that I'm paranoid about it, it's that no one hosts the dynamic combo builder over SSL. I'm already living with the risk of loading external JS for Stripe and Google Analytics. – Jeremy Wadhams Jan 31 '13 at 17:56

2 Answers2

9

The easiest way to solve it is to change base URL from
http://yui.yahooapis.com/ to
https://yui-s.yahooapis.com/

Aram Sahradyan
  • 189
  • 1
  • 4
  • I use Version 3.17.2. I localized the yui-min.js to my server and replaced yui.yahooapis.com with yui-s.yahooapis.com in its code. This just worked for me! Or try to change base URL like in this answer: https://stackoverflow.com/a/12256184/1269608 – Martin Krung Aug 21 '18 at 21:57
3

Depending upon your server environment, you have a couple of options.

Development

  • Download the latest YUI library, and upload the yui/build/ folder to your server. The seed file should work fine without modification, though you won't be able to take advantage of combo loading.

Production

  • Use the YUI Configurator to determine all the files that you will need for each module set, and download them manually from the combo links provided. Rename them to something suitable like yui3.8.0-node-rollup.js and serve these to your users.

Be advised that if you use different module sets for different scripts, you may need to make multiple sets of files from this process, depending upon how you set it up. There is also a question here about concatenating Javascript together, if you are curious.

As an addendum, in my past research, I discovered that pulling external libraries over a secure connection may not be a safe idea.

Community
  • 1
  • 1
Ryan Stein
  • 7,930
  • 3
  • 24
  • 38