Module Federation Security

Security Overview

Security lets you structure Module Federation work so it stays readable, testable, and easy to scale. Instead of ad-hoc code, you follow a clear pattern that other developers can recognise immediately.

The key is to keep security focused and predictable. Start from the minimal example here, then layer in only the complexity your feature actually needs.

const ProductList = React.lazy(() =>
  import('catalog/ProductList').catch(() => ({
    default: () => <p>Catalog is temporarily unavailable</p>,
  })),
);

Always provide a fallback so a failing remote degrades gracefully instead of crashing the shell.

Security Example

new ModuleFederationPlugin({
  name: 'app',
  filename: 'remoteEntry.js',
  exposes: { './Widget': './src/Widget' },
  remotes: { other: 'other@http://host/remoteEntry.js' },
  shared: { react: { singleton: true } },
});

• Start from a minimal Security example and grow it only as needed.
• Keep configuration explicit so Security behaves the same in every environment.
• Name things clearly so teammates understand your Security at a glance.
• Add tests around Security early to lock in expected behaviour.

Module Federation Cheatsheet

Key Module Federation settings related to security.

How Security Works in Module Federation

Security builds on Module Federation's ability to load code from another independently built and deployed application at runtime. Each app can be a host, a remote, or both.

Always provide a fallback so a failing remote degrades gracefully instead of crashing the shell.

• Remotes expose modules through a remoteEntry.js manifest.
• Hosts declare remotes and import exposed modules dynamically.
• Shared dependencies are deduplicated, ideally as singletons.
• Each micro frontend builds and deploys on its own schedule.

Practical Guidance for Security

In production, security needs careful version management and graceful failure handling. Align shared dependency versions and always render a fallback when a remote cannot load.

Common Mistakes

• Copying security snippets without understanding what each line does.
• Skipping error handling and edge cases when wiring up security.
• Leaving security untested, so regressions slip into production.
• Over-engineering security before you actually need the extra flexibility.

Key Takeaways

• Security is a core part of working effectively with Module Federation.
• Start small and keep security focused on a single responsibility.
• Apply consistent patterns so security scales across your project.
• Test and document security to keep it maintainable over time.