JavaScript component filenames become invalid after hash salt change/rotation

Created on 4 June 2025, 3 days ago

Overview

When the compiled JavaScript and CSS code for code components get written to a file, the filename is calculated using \Drupal\Component\Utility\Crypt::hmacBase64 with Settings::getHashSalt() as the key. Whenever we access the files, the filename is re-calculated on-the-fly. Due to relying on the value of Settings::getHashSalt(), the filenames are not stable.

  1. Rotating the hash salt is a security best practice;
  2. Cloning database and files between different environments can happen, and different environments will have different hash salt values.

These scenarios cause the Astro Islands to point at non-existing files.

Proposed resolution

Change the way the filename is calculated or store the calculated filename on the JavaScriptComponent entity instead of calculating it on-demand.

More context:

  1. The code for calculating the filenames was added in commit 9d295 in Implement OAuth2 authentication for API endpoints related to code components Active .
  2. @longwave suggested if we could "use a more user friendly filename and rely on the Drupal cache busting query string to handle invalidation" while working on Storage for global CSS Active , and Wim agreed as a future improvement. Maybe it's time to make that happen?
🐛 Bug report
Status

Active

Version

0.0

Component

Theme builder

Created by

🇳🇱Netherlands balintbrews Amsterdam, NL

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Production build 0.71.5 2024