3 ms·
The code they source from the third-party initially can be audited and then self hosted. If the code is not self hosted, the third party can change the script t
by bsilvereagle 11y ago
The code they source from the third-party initially can be audited and then self hosted. If the code is not self hosted, the third party can change the script to be malicious (or be compromised) without the first party ever knowing.
- Phemist 11y agoI think this is why integrity hashes should be included anytime a CDN is used to load a third-party library. Bootstrap does this, for example: http://getbootstrap.com/getting-started/ http://getbootstrap.com/getting-started/ I'd like to see more lib providers, and even CDNs themselves, follow suit.
- Too 11y agoThank you, i always thought about this but didn't know it already existed. This should definitely be used for any content included on a page, especially third party CDN, it could also allow caching if the address changes but the content is the same.