3 ms·
See https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
by spankalee 11y ago
See https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
- dheera 11y agoThanks! It seems that the "integrity" attribute is aimed at preventing XSS. I would totally support that as well. Perhaps the "integrity" attribute can be taken advantage of by browsers automatically for cross-site caching, in addition to its intended purpose of preventing cross-site scripting attacks?
- vorotato 11y agoCross-site caching adds all the risk you intend to take away by adding the integrity attribute. What if someone makes a Jquery.js file that hash-conflicts with the version you have, but has a malicious payload. You visit bob.com, get the infected jquery with the hash 0xcafebabe, which just so happens to match with jquery's 0xcafebabe. You might say wow how unlikely, but with entire botnets dedicated to guessing matching hashes, something like this could be devastating.