Improved Support for Lua Modules

One of the lesser-known features of Webscript is its support for importing Lua modules directly from GitHub. To be completely honest, I personally didn't expect this feature to be a major part of how people used Webscript, but in the short week since we launched, we've already seen a number of people importing their own modules. Because of the enthusiasm we saw, we spent some time this week building better support for using existing Lua modules with Webscript.

Simplified "require" paths

To import a module from GitHub, you need to call require('<GitHub user>/<repository>/<path to .lua file>'). This syntax still works as it did before, but we've made two improvements:

  1. You can leave off the .lua extension. For those of you who use Lua outside of Webscript, this is the typical convention. We've updated all our examples to omit the extension.
  2. If you're importing from our main repository (, you can leave off the GitHub user and repository entirely. We've updated our examples to do this.

To sum it up, instead of writing this:


you can now just write this:


Broadened support for Lua features

For security reasons, Webscript runs scripts in a sandboxed environment. The right way to build a sandbox is to use a whitelist, rather than a blacklist. What that means is that we have a list of functions that we allow, and all others are removed from the Lua environment.

To provide better compatibility with existing Lua modules, we've expanded the whitelist to include a few important functions, notably setfenv and module. It's okay if you don't know what those are; the point is that they're frequently used by modules you might like to reference, not that you'll be using them in your own scripts.

Requiring modules with multiple files

It's common in more complex Lua modules for the code to be spread out across multiple files. For example, you might have the files mymodule.lua, mymodule/foo.lua, and mymodule/bar.lua. At the top of mymodule.lua, you might see something like this:

foo = require ''
bar = require ''

These dotted names are essentially relative paths. (They're relative to the directory where the main module file is located.) Webscript can now resolve such names in the context of importing a module from GitHub, so you can make use of complex modules that have multiple files.

A few miscellaneous things

In addition to the above, we made a few smaller changes. Like Lua itself does, we now ignore the first line of a module if it starts with a hash (e.g. #!/usr/bin/env lua). We also pass to the module its name and path (as a GitHub path), like Lua typically does. I doubt you'll notice these except to see that more modules now "just work."

Give us feedback

Thank you to a few of our users who gave feedback on this, notably Alex Kessinger, who was quite generous with his time. Webscript is a fairly general tool, so we need feedback from users to learn how they're using the service and what they would like to see.

If you're trying to use Lua modules and running into trouble, or if you have any other feedback, please reach out to our team at