4 ms·
> What I've done here is add the SRI Integrity Attribute and that allows the browser to determine if the file has been modified, which allows it to reject the f
by petagonoral 9y ago
> What I've done here is add the SRI Integrity Attribute and that allows the browser to determine if the file has been modified, which allows it to reject the file
Wouldn't this negate one of the benefits of a 3rd party hosted SaaS?
Otherwise, you have to redeploy everytime your provider updates their lib?
- teej 9y agoIt’s not uncommon to freeze 3rd party libs. Do you want a 3rd party provider to have access to hot deploy to your website?
- gokhan 9y agoPossible if the 3rd party script is versioned.
- stordoff 9y agoIsn't that the same as freezing the script (except still loading from a remote and using SRI to enforce that it wasn't changing)?
- petagonoral 9y ago> It’s not uncommon to freeze 3rd party libs Sure. 3rd party libs your code uses directly. Haven't seen it too much with 3rd party service providers code that are somewhat outside your code boundaries. Taking 2 different popular 3rd party SaaS that are included as JS in sites as an example. Google Analytics uses url of https://www.google-analytics.com/analytics.js https://www.google-analytics.com/analytics.js [1] Stripe uses url of https://js.stripe.com/v3/ https://js.stripe.com/v3/ [2] < Do you want a 3rd party provider to have access to hot deploy to your website? Clearly not. Nor was this inferred. [1] https://developers.google.com/analytics/devguides/collection/analyticsjs/ https://developers.google.com/analytics/devguides/collection... [2] https://stripe.com/docs/stripe-js/reference https://stripe.com/docs/stripe-js/reference