Is there a minimal/lite/lazy version for utilizing MSAL in an SPA like React?

[is-jonreeves]

I've been auditing some of our project's deps recently and was really surprised to see MSAL coming in at 900KB. It is by far the largest dep we have in our SPAs.

The @azure/msal-react is relatively small itself, but the required @azure/msal-common and @azure/msal-browser libs appear to be huge. While we do make use of gzip to deliver the bundles (and that reduces things to around 200KB), proportionally, its still massive compared to everything else we use.

For now, I have had to institute a custom chunking strategy to minimize the impact to users (probably worth doing anyways), and isolate MSAL to its own vendor group so that this payload can be cached for longer and not invalidated (until upgraded). While this is at least something, its does nothing to speed up things for incognito/first-time visitors.

The biggest issue for me is that MSAL being an Auth lib, is effectively a blocking one. The App cannot display or become interactive until knowledge of authentication is known. Therefore until the entire set of MSAL libs are loaded (and a token request is made) you are waiting around.

I've gone over the implementation docs a number of times, so I think I know the answer, but felt it best to be sure...

Is there a "lite" version that can be made use of instead, or perhaps an approach (in React) which would result in code-splitting the necessary functions to get the App interactive and then lazy loading the remainder in the background?

One last thing worth mentioning, is that I have used both @auth0/auth0-react and @clerk/clerk-react and both manage to come in at between 50-70KB (without gzip).

[sameerag]

We are trying to minimize our foot print in the upcoming releases. There are minor improvements we made to the bundle size, however for the amount of gains you are asking, it is in our pipeline, nothing concrete yet. cc @EmLauber @konstantin-msft