In the scenario you mention, you're scuppered regardless of whether sessions are stored. The best way to mitigate this particular problem is to use subresource

In the scenario you mention, you're scuppered regardless of whether sessions are stored. The best way to mitigate this particular problem is to use subresource integrity: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...