This project is not covered by Drupal’s security advisory policy.

Use allow and block lists for libraries, differentiated by anonymous and authenticated users.

Features

  • disable CSS and JS libraries differentiated by anonymous and authenticated users
  • allow/deny complete modules or only some libraries of modules
  • disable external libraries of all modules (experimental)
  • disable CDN usage of webform module

Post-Installation

By default a allow list is used for anonymous visitors and a deny list for authenticated users. The active theme and it's parent themes are also allowed by default.

To get the old behavior, set the list mode for anonymous visitors from "allow" to "deny".

Allow and deny lists aren't active at the same time. Depending on the list mode, one or the other is used. But both lists are stored independently so you can switch between modes with preconfigured lists.

Allow lists example

system
views/views.module
views/views.ajax/js

Deny lists example

webform
contact
system/base
views/views.ajax/js

Side effects

This module adds a cache context to library_info:theme_name:<anonymous|authenticated> in the cache_discovery table. Without this module, two cached keys are expected:

  • library_info:claro (admin theme)
  • library_info:theme_name (theme)

In theory, the admin theme can’t be loaded as anonymous user, so three cached keys are expected:

  • library_info:claro:authenticated (admin theme)
  • library_info:theme_name:anonymous (theme)
  • library_info:theme_name:authenticated (theme)

Similar projects

  • Library manager (not tested, yet) - can be used to overwrite libraries, but it doesn't differentiate between authenticated and anonymous users. From skimming the source code it also doesn't look like disabling libraries is possible.

Supporting this Module

TODO

Community Documentation

See README.md and CHANGELOG.md in the source code for more details and the technical background.

Project information

Releases