--- title: Lazy-Loading as a Security Measure | daily.dev description: Explores using lazy loading as a security measure to protect sensitive frontend code, not just for performance optimization. Discusses how deferring module... canonical: https://daily.dev/posts/pq5edfix1 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Lazy-Loading as a Security Measure | daily.dev og:description: Explores using lazy loading as a security measure to protect sensitive frontend code, not just for performance optimization. Discusses how deferring module... og:url: https://daily.dev/posts/pq5edfix1 og:image: https://api.daily.dev/og/posts/pq5eDFIx1.png og:image:alt: Post cover image og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Lazy-Loading as a Security Measure **[Bob Fornal](https://daily.dev/sources/nu7mxj5kr)** · [@rfornal](https://daily.dev/rfornal) · 110 upvotes · 6 comments ## Summary Explores using lazy loading as a security measure to protect sensitive frontend code, not just for performance optimization. Discusses how deferring module loading until after authentication can reduce attack surface in SPAs by preventing sensitive code from being exposed in initial bundles. Covers implementation patterns in Angular and React, emphasizing this should be one layer in a holistic security approach alongside backend protections. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community discussion Top comments from developers on daily.dev. **@confused\_snake** · 20 upvotes > Lazy loading by itself does not provide any additional security, as the user can just examine the code and load the lazy loaded routes manually. You’d actually need to configure your webserver to only serve those routes to authenticated users and need to set proper caching headers. **@ghost** · 3 upvotes > While lazy-loading is definitely a great addition to your project, it's not a security measure. **@whitland** · 1 upvotes > Is this only valid in the context of SPAs then? Or do you imagine that this is a benefit outside SPAs or even outside web dev? > (Is Haskell the ultimate language? 😛) > > Good read, you showed me a new perspective. Thanks 👍 ## Similar posts on daily.dev - [Don’t just attend KubeCon \+ CloudNativeCon, Merge Forward your experience\!](https://daily.dev/posts/don-t-just-attend-kubecon-cloudnativecon-merge-forward-your-experience--l0rpp73x8) · CNCF · 1 upvotes · 0 comments - [Announcing H2 2026 KCDs](https://daily.dev/posts/announcing-h2-2026-kcds-m96goajm1) · CNCF · 1 upvotes · 0 comments - [Two months of Open Community Groups](https://daily.dev/posts/two-months-of-open-community-groups-asf52zhbs) · CNCF · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#webdev](https://daily.dev/tags/webdev), [#react](https://daily.dev/tags/react), [#frontend](https://daily.dev/tags/frontend), [#angular](https://daily.dev/tags/angular) [View this post on daily.dev](https://daily.dev/posts/pq5edfix1) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/pq5edfix1","headline":"Lazy-Loading as a Security Measure","text":"Shared: Lazy-Loading as a Security Measure","url":"https://daily.dev/posts/pq5edfix1","datePublished":"2025-10-08T12:07:46.450Z","dateModified":"2025-10-08T12:08:23.567Z","author":{"@type":"Person","name":"Bob Fornal","url":"https://daily.dev/rfornal","image":"https://lh3.googleusercontent.com/a-/AOh14Gj2w_EqKb5Jlbize6-gm6oXVU1CV3KM2mEuTrAhCQ=s100","description":"Microsoft MVP | Torc Ambassador | Real, Fun, Geek","worksFor":{"@type":"Organization","name":"Leading EDJE","logo":"https://res.cloudinary.com/daily-now/image/upload/s--_zUDDMv4--/f_auto/v1726138952/companies/leadingedje"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":660}},"image":"https://media.daily.dev/image/upload/s--2-1xRawN--/f_auto/v1722860399/public/Placeholder%2011","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":110},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":6}],"sharedContent":{"@type":"WebPage","url":"https://api.daily.dev/r/3uR8XJYYO"},"comment":[{"@type":"Comment","text":"Lazy loading by itself does not provide any additional security, as the user can just examine the code and load the lazy loaded routes manually. You’d actually need to configure your webserver to only serve those routes to authenticated users and need to set proper caching headers.","datePublished":"2025-10-24T03:16:08.580Z","url":"https://daily.dev/posts/pq5eDFIx1#c-y6zk3tUhG","author":{"@type":"Person","name":"A","url":"https://daily.dev/confused_snake","image":"https://media.daily.dev/image/upload/s--O0TOmw4y--/f_auto/v1715772965/public/noProfile"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":20}},{"@type":"Comment","text":"While lazy-loading is definitely a great addition to your project, it’s not a security measure.","datePublished":"2025-11-04T08:34:25.119Z","url":"https://daily.dev/posts/pq5eDFIx1#c-3exFkOp7y","author":{"@type":"Person","name":"Deleted user","url":"https://daily.dev/ghost","image":"https://media.daily.dev/image/upload/s--hNIUzLiO--/f_auto/v1705327420/public/ghost_vlftth"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3}},{"@type":"Comment","text":"Is this only valid in the context of SPAs then? Or do you imagine that this is a benefit outside SPAs or even outside web dev?\n(Is Haskell the ultimate language? 😛)\nGood read, you showed me a new perspective. Thanks 👍","datePublished":"2025-11-14T10:07:01.859Z","url":"https://daily.dev/posts/pq5eDFIx1#c-7DNrFS1zb","author":{"@type":"Person","name":"David","url":"https://daily.dev/whitland","image":"https://media.daily.dev/image/upload/s--O0TOmw4y--/f_auto/v1715772965/public/noProfile"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/nu7mxj5kr","name":"Bob Fornal"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Bob Fornal","item":"https://daily.dev/sources/nu7mxj5kr"},{"@type":"ListItem","position":3,"name":"Lazy-Loading as a Security Measure"}]} ```