4 ms·
I think it would be bad practice to use this keyword on end-point URL's that are advertised in search engines or API documentation. You would want to use it fo
by martinflack 10y ago
I think it would be bad practice to use this keyword on end-point URL's that are advertised in search engines or API documentation.
You would want to use it for resources to which base pages and manifests point; such as JS, CSS, JPG, PNG, etc.
The browser could enforce that, sort of. It could ignore immutable cache status on the object that is actually in the browser location bar and IMS it, but it could allow it on referenced objects.
The idea is that referenced objects can simply stop being referenced, and a fresh object is referenced.
- nemothekid 10y agoThe point still stands. Some wordpress install that references /parralax-plugin.js could be hijacked to server malicious JS with an immutable header. A possible solution would be to only use the immutable header with integrity html tag.
- Ciantic 10y agoI think the point is that it would be renamed /parallax-plugin2.js and HTML would be set to reference that instead? That is why immutable cache shouldn't work for the page in the address bar.
- JoshTriplett 10y agoThe concern here is that even after recovery from the compromise, the site could then never use the name "parallax-plugin.js" again, because a browser might have the cached malware under that name instead of the correct version.
- jakub_g 10y agoOn top of that you as a developer would have to understand what's happening and that it's happening at all. Might be not easy as we have a habit on clearing our cache all too often :)