3 ms·
> ... but you can be assured that the network calls your page are making are hitting the correct 3rd parties ... The browser's sandbox security model already d
by asaph 8y ago
> ... but you can be assured that the network calls your page are making are hitting the correct 3rd parties ...
The browser's sandbox security model already does this for us with the same origin policy.
> ... and even inspect to see that the payloads are "correct".
This is what SRI already does for us.
- jszymborski 8y agoTo the second point, I was thinking of checking what came over the wire after AJAX calls from 3rd party JS (which may or may not have been loaded with SRI). I'll have to concede the first point... I was thinking that you can whitelist entire URLs to be fetched as opposed to domains, but on second thought, I don't think that'd be a meaningful change. Thanks, this has made me think a lot more on this, however :)