3 ms·
The point still stands. Some wordpress install that references /parralax-plugin.js could be hijacked to server malicious JS with an immutable header. A possibl
by nemothekid 11y ago
The point still stands. Some wordpress install that references /parralax-plugin.js could be hijacked to server malicious JS with an immutable header.
A possible solution would be to only use the immutable header with integrity html tag.
- Ciantic 11y agoI think the point is that it would be renamed /parallax-plugin2.js and HTML would be set to reference that instead? That is why immutable cache shouldn't work for the page in the address bar.
- JoshTriplett 11y agoThe concern here is that even after recovery from the compromise, the site could then never use the name "parallax-plugin.js" again, because a browser might have the cached malware under that name instead of the correct version.
- jakub_g 11y agoOn top of that you as a developer would have to understand what's happening and that it's happening at all. Might be not easy as we have a habit on clearing our cache all too often :)