3 ms·
It's probably best to completely avoid all third-party resources in most cases. You never know if the service will still be around a few years later, or even wo
by TheAceOfHearts 9y ago
It's probably best to completely avoid all third-party resources in most cases. You never know if the service will still be around a few years later, or even worse the service could be taken over by a malicious actor.
I'd extend the restriction to third-party APIs as well. Instead of hitting third-party services directly, consider proxying all requests. Aside from protecting the user's privacy, it makes it easier to switch out the underlying implementation if the need arises. Oh, and it lets you avoid CORS, which developers still occasionally screw up with.
- calpaterson 9y ago> even worse the service could be taken over by a malicious actor This particular problem is partly mitigated by subresource integrity (hashes of third party resources you put in the html tag). For my money, there are plenty of situations where third-party resources are acceptable. Ultimately that is basically what a CDN is, which most serious websites rely heavily on (often sharing their SSL certs).
- billyhoffman 9y agoYou almost always have a business relationship with your CDN that’s serving your content. You often don’t have that relationship with random third parties you Script src or link href in