Skip to content
Created: August 12, 2020

What are micro frontends? ​

Micro frontends let teams independently develop and deploy applications composed into one product. Frameworks provide loading, lifecycles, routing and communication; runtime isolation reduces accidental interference without automatically establishing a malicious-code boundary.

Implementation comparison ​

Defaults vary by version and options; measure performance, compatibility and integration cost in the target project rather than using star ratings.

SolutionJS integrationStyle isolationImportant limits
qiankunsingle-spa lifecycles and JS sandboxOptional scoped prefixes or ShadowDOMMainly limits accidental pollution
micro-appCustom elements and JS sandbox; iframe mode depends on versionScoped prefixes by default, optional ShadowDOMCustomElement does not imply default ShadowDOM
WujieSame-origin iframe JS, document proxied to host WebComponentShadowDOM; evaluate fallbacks separatelySub-apps can access window.parent
EMP / Module FederationBuild-time exposure, runtime loading/shared dependenciesApplication-definedShared context, not browser-level isolation
iframeIndependent browsing contextSeparate documentSecurity depends on separate origins and sandbox policy

Selection criteria ​

  • Validate route ownership, dependencies, loading failures and rollback for independent releases.
  • Test actual legacy artifacts rather than assuming every stack integrates unchanged.
  • Design separate-origin iframes, sandbox policies, communication permissions and server authorization for untrusted apps; Proxy or same-origin iframes are insufficient.
  • Verify first-screen performance, switching and SSR against versions and actual devices.

Routing ​

The host owns entry and loading rules; child-route independence and URL synchronization depend on mode and configuration. Test refreshes, back navigation, deep links and unmounting.

SolutionRouting
qiankunactiveRule activation; avoid host/child conflicts
micro-appVirtual routes and synchronization configured by version
WujieConfigurable synchronization of iframe history and host URL
Module FederationHost/remote integration defines routing
iframeSeparate URL with explicit host-state communication

Web Components ​

CustomElement provides custom tags and lifecycles; ShadowDOM provides DOM encapsulation and style scoping. Custom elements need not create a ShadowRoot, and ShadowDOM is not an authorization or malicious-script boundary.

Style isolation ​

  • Scoped prefixes rewrite selectors; verify global selectors, popups and dynamic styles.
  • ShadowDOM isolates most selectors; handle inheritance, CSS variables and external popups.
  • CSS Modules / BEM reduce naming collisions, not malicious-code risks.
  • Iframes separate document styles; security still depends on origins, sandbox and communication permissions.

Communication ​

SolutionCommon communication
qiankunprops and initGlobalState
micro-appdata, dispatch and framework APIs
Wujieprops, window.parent and bus
Module FederationExported functions, components or shared modules
iframepostMessage with origin, source and payload validation

Define protocol versions, ownership, subscription cleanup and errors; frontend identity does not replace server authorization.

Implementation references ​

qiankun ​

Uses single-spa lifecycles, JS sandboxing and configurable style isolation. Verify ESM, Vite and sandbox support by version.Official documentation.

micro-app ​

Custom elements load sub-apps; default prefixes and optional ShadowDOM are separate modes. Verify iframe and route APIs by version; ShadowDOM does not explain JS execution or routing.Style isolation.

EMP / Module Federation ​

Declare exposed/shared modules at build time and load remote code with dependency negotiation at runtime, not only at build time. Design singleton settings, version constraints and failure handling.Module Federation.

Wujie ​

JS runs in a same-origin iframe, document is proxied to a host WebComponent and ShadowDOM isolates styles. Sub-apps can access window.parent; reduced pollution does not establish safe execution of malicious code.Implementation.