3 ms·
You are totally right, but I'm wondering if we shouldn't change this practice. I'm starting to think if you're making a call to an external service, it should b
by jszymborski 8y ago
You are totally right, but I'm wondering if we shouldn't change this practice. I'm starting to think if you're making a call to an external service, it should be proxied through your network.
It'd increase bandwidth/latency, but you can be assured that the network calls your page are making are hitting the correct 3rd parties, and even inspect to see that the payloads are "correct".
Edit: Surely, this at the very least should be the case for payment pages and banking websites.
- asaph 8y ago> ... but you can be assured that the network calls your page are making are hitting the correct 3rd parties ... The browser's sandbox security model already does this for us with the same origin policy. > ... and even inspect to see that the payloads are "correct". This is what SRI already does for us.
- jszymborski 8y agoTo the second point, I was thinking of checking what came over the wire after AJAX calls from 3rd party JS (which may or may not have been loaded with SRI). I'll have to concede the first point... I was thinking that you can whitelist entire URLs to be fetched as opposed to domains, but on second thought, I don't think that'd be a meaningful change. Thanks, this has made me think a lot more on this, however :)