3 ms·
The solution to this is including a checksum with the link to the file, and if the checksum doesn't match, don't load the file. See https://developer.mozilla.o
by eertami 10y ago
The solution to this is including a checksum with the link to the file, and if the checksum doesn't match, don't load the file.
See https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres... though it isn't universally supported yet.
- jonlucc 10y agoJust so I understand, I pull the file and make a checksum, then hardcode it into the link to the resource in my own code? Then, when the client pulls my code, follows the link, checks the checksum against the one I included in the link.
- dexterdog 10y agoYes. It's very simple. I don't know why more library providers don't have it in their copyable <script> snippets.