Benefits vs. Pitfalls of hosting jQuery locally

Question

We're currently pulling jQuery and jQueryUI (and jQueryUI CSS) libraries from the google CDN. I like this because I can call google.load("jquery", "1");
and the latest jQuery 1.x.x will be used.

Now I am to pull the libraries locally because of security.

I'm happy to pull them locally but I'm wondering what are some of the other benefits and pitfalls to watch out for?

Answer 1

I don't like downloading libraries from third party servers, because any new version can introduce an incompatible change or a bug the testing team missed. I don't want my website to break just because jQuery team posted a new version.

Answer 2

The main benefit of having them on a CDN is that the files can be downloaded in parallel to files downloaded from your own website. This reduces latency on every page. So, the flip side of this is a pitfall of hosting locally - increased latency. The main reason for that is that browsers are limited in the number of connections that they can make at the same time to the same webserver. In IE6 this was defaulted to 2 concurrent connections to the same domain - shared between all open windows of IE!! In IE8 it is a bit better, defaulting to 6, which is inline with FF, but still, if you have a lot of images and you are not using sprites, you will experience heavy latency.

Using a CDN, I would always set the library version explicitly rather than getting the latest one. This reduces the risk of new versions breaking your code. Not very likely with jQuery, but possible.

The other main benefit of using a CDN is reduced traffic on your site. If you pay per GB or you are on a virtual server with limited resources, you might find that overall site performance increases and hosting costs come down when you farm off some of your content to a public CDN.

Answer 3

Google CDN:

• caching, good for performance, more users likely to have it already, and it downloads in parallel
• if ever, heaver forbid cdn goes down. you're screwed.
• if a new version breaks your existing plugins or site, you'll know about it possibly too late

Locally:

• development without being connected to the net is possible
• can still get some performance benefits by gzipping, in addition to minifying

Answer 4

i alway use the CDN from Google. But just in case its offline:

<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.min.js"&gt;&lt;/script&gt;
<script>!window.jQuery && document.write('<script src="jquery-1.4.2.min.js"><\/script>')</script>

Grab Google CDN's jQuery and fall back to local if necessary

Answer 5

Benifits (iam talking of google cdn)

1. downloaded in parallel with ur files.
2. goolge servers have less response time.
3. files are cached.
4. if some other site has already downloaded that file then your site wont download it again it will just pick it from cache.
5. your bandwidth would be saved.

Answer 6

Virtually every way you look at it, using Google's CDN is a good thing.

Performance will be improved (albeit fairly marginally, unless your site is really busy), and the amount of data your servers have to transmit will go down (although jQuery isn't exactly a massive thing to download), etc.

The only reason you wouldn't want to use it is if you don't trust Google. By using it, you are effectively giving Google an additional window of information into your site's traffic profile, including knowledge of URLs that you may otherwise not want to make public (eg secure areas of your site).

If you are paranoid about security then this may be enough to persuade you not to use them (after all, hosting it yourself isn't exactly going to slow your site down to a crawl), but in general most people would take the pragmatic view that Google knows enough about their site already that adding this won't make much difference.

Answer 7

I prefer to use my local version, because I don't have control about what they will provide. For example I don't want my users to get affected by google-analytics or anything similar, because this is a legal problem in my country.

Answer 8

Others have covered the benefits. Pitfalls:

• If you only include content from your own server, that's one server that needs to be running—and not blocked by firewalls etc—to make your site work. Pull script from a third party and now that's two servers that need to be running and unblocked to make your site work.

• Any site you pull <script> from can completely control the user's experience on your site. If Google were feeling evil they could put something in their copy of jQuery to log your keypresses, steal personal information from the page you're on to tie into their web tracking database, make you post “I love Google!” comments to every form, and so on.

Google probably aren't actually going to do that, but it's a factor that's out of your control, and certainly something to worry about with other script-hosting services. There have been incidents before where stats scripts have been compromised with malware loaders.

Before including any script from a third party—even on one single page of your site—you must 100% trust them with all user-accessible functionality visible on that hostname (including web-facing admin functions).