What are micro frontends?
Micro frontends let teams independently develop and deploy applications composed into one product. Frameworks provide loading, lifecycles, routing and communication; runtime isolation reduces accidental interference without automatically establishing a malicious-code boundary.
Implementation comparison
Defaults vary by version and options; measure performance, compatibility and integration cost in the target project rather than using star ratings.
| Solution | JS integration | Style isolation | Important limits |
|---|---|---|---|
| qiankun | single-spa lifecycles and JS sandbox | Optional scoped prefixes or ShadowDOM | Mainly limits accidental pollution |
| micro-app | Custom elements and JS sandbox; iframe mode depends on version | Scoped prefixes by default, optional ShadowDOM | CustomElement does not imply default ShadowDOM |
| Wujie | Same-origin iframe JS, document proxied to host WebComponent | ShadowDOM; evaluate fallbacks separately | Sub-apps can access window.parent |
| EMP / Module Federation | Build-time exposure, runtime loading/shared dependencies | Application-defined | Shared context, not browser-level isolation |
| iframe | Independent browsing context | Separate document | Security depends on separate origins and sandbox policy |
Selection criteria
- Validate route ownership, dependencies, loading failures and rollback for independent releases.
- Test actual legacy artifacts rather than assuming every stack integrates unchanged.
- Design separate-origin iframes, sandbox policies, communication permissions and server authorization for untrusted apps; Proxy or same-origin iframes are insufficient.
- Verify first-screen performance, switching and SSR against versions and actual devices.
Routing
The host owns entry and loading rules; child-route independence and URL synchronization depend on mode and configuration. Test refreshes, back navigation, deep links and unmounting.
| Solution | Routing |
|---|---|
| qiankun | activeRule activation; avoid host/child conflicts |
| micro-app | Virtual routes and synchronization configured by version |
| Wujie | Configurable synchronization of iframe history and host URL |
| Module Federation | Host/remote integration defines routing |
| iframe | Separate URL with explicit host-state communication |
Web Components
CustomElement provides custom tags and lifecycles; ShadowDOM provides DOM encapsulation and style scoping. Custom elements need not create a ShadowRoot, and ShadowDOM is not an authorization or malicious-script boundary.
Style isolation
- Scoped prefixes rewrite selectors; verify global selectors, popups and dynamic styles.
- ShadowDOM isolates most selectors; handle inheritance, CSS variables and external popups.
- CSS Modules / BEM reduce naming collisions, not malicious-code risks.
- Iframes separate document styles; security still depends on origins, sandbox and communication permissions.
Communication
| Solution | Common communication |
|---|---|
| qiankun | props and initGlobalState |
| micro-app | data, dispatch and framework APIs |
| Wujie | props, window.parent and bus |
| Module Federation | Exported functions, components or shared modules |
| iframe | postMessage with origin, source and payload validation |
Define protocol versions, ownership, subscription cleanup and errors; frontend identity does not replace server authorization.
Implementation references
qiankun
Uses single-spa lifecycles, JS sandboxing and configurable style isolation. Verify ESM, Vite and sandbox support by version.Official documentation.
micro-app
Custom elements load sub-apps; default prefixes and optional ShadowDOM are separate modes. Verify iframe and route APIs by version; ShadowDOM does not explain JS execution or routing.Style isolation.
EMP / Module Federation
Declare exposed/shared modules at build time and load remote code with dependency negotiation at runtime, not only at build time. Design singleton settings, version constraints and failure handling.Module Federation.
Wujie
JS runs in a same-origin iframe, document is proxied to a host WebComponent and ShadowDOM isolates styles. Sub-apps can access window.parent; reduced pollution does not establish safe execution of malicious code.Implementation.