[wasm] implement browser cache busting for `JSHost.ImportAsync`

[pavelsavara]

Similar to what Blazor does or with file hash in mono-config.json applied as query string.

Also cache busting for JSHost.ImportAsync

Tagging subscribers to 'arch-wasm': @lewing
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Similar to what Blazor does or with file hash in mono-config.json applied as query string.

Author:	pavelsavara
Assignees:	pavelsavara
Labels:	arch-wasm, area-System.Runtime.InteropServices.JavaScript
Milestone:	8.0.0

[maraf]

Fingerprinting is handled by the static web assets. We should probably add modules for JSHost.ImportAsync into boot config and pick fingerprinted URL from there

[pavelsavara]

JSHost.ImportAsync could be any URL, not just current project.
It could be some 3rd party CDN.

Users could already add ?guid=cb2a5dff-1f74-4d35-b8cf-c6327b2f45b1 or ?etag=whatever-xxx1.
But that doesn't check integrity. I think that is the missing bit there.
Could <script type="importmap"> help somehow ?

[maraf]

JSHost.ImportAsync could be any URL, not just current project.
It could be some 3rd party CDN.

Does it block us from using it through boot config? Just omit the fingerprinting of course, but it could be the place to provide integrity.

[pavelsavara]

If there was such section in boot config, how would the hashes get there. We are not going to download from CDN in order to calculate the hash, right ? Should we have MSbuild item for adding records there and let user to drive it ?

The JSHost.ImportAsync is just dynamic JS import(). That doesn't have integrity. Unless we are willing to inject prefetch tags into DOM.
For cache busting we could append the query string on our own.

But I feel this may be overstepping our responsibilities ?

[maraf]

That dynamic import doesn't support integrity is good point. My though was that it would be user job to fill msbuild item with integrity.

For CDNs I think it's their job to provide good caching story and I would let user to do it manually if needed (appending query string).

For local scripts, SWA will put fingerprint into assets with name like file.[fingerprint].js and I would use boot config to load such fingerprinted modules.

[maraf]

Moving to .NET 9 as the underlaying issue has moved dotnet/aspnetcore#47000