4 ms·
If you're using a third party cdn to serve js assets then you have no chance to assure security.
by ilikehurdles 8y ago
If you're using a third party cdn to serve js assets then you have no chance to assure security.
- thaumasiotes 8y agoNot quite true; you can set a Content-Security-Policy header which whitelists scripts by their cryptographic hash. Assuming you know the exact contents of the script you want to run (which you should, if the only issue is that you're using a CDN), this should be fine. Just set the header yourself. If you're letting third parties load arbitrary code on your site, that's harder to deal with. Then a compromise of them is likely to also be a compromise of you.
- dotancohen 8y agoIf you're using a third party CDN to serve Javascript assets on a page that requests users to enter sensitive information, such as credit card details, then you are DOING IT WRONG. Seriously, do the devs not realize that "cloud" means "somebody else's computer" and using "cloud assets" on your payment pages means somebody else is deciding what Javascript to run on your payment pages?