3 ms·
What you can do with some CDNs is have a self-served loader that pulls the files from the CDN using XHR (requiring CORS headers...), verifies the content hash,
by ryan-c 11y ago
What you can do with some CDNs is have a self-served loader that pulls the files from the CDN using XHR (requiring CORS headers...), verifies the content hash, then injects it into the page if it looks good. I have a PoC on github https://github.com/ryancdotorg/verifyjs https://github.com/ryancdotorg/verifyjs - same sort of thing could be modified to support signed files rather than hashed, which SRI can't do.
- mxpxrocks10 11y agothat's a pretty cool POC Ryan. Do you know @jdorfman? You guys should hook up
- ryan-c 11y agoI do not - I mainly do arcane infosec work and only in the past two years or so (I've gotten better with javascript in that time) have I been doing non-trivial client side stuff. Consequently, most of my professional contacts are in infosec.
- mxpxrocks10 11y agocool. I asked him to drop you a line