3 ms·

Third-party should not be the qualifier here. Cloudflare's CDNJS sets, by default, crossorigin=anonymous and subresource integrity. Add a "Referrer-Policy: no-

Third-party should not be the qualifier here. Cloudflare's CDNJS sets, by default, crossorigin=anonymous and subresource integrity. Add a "Referrer-Policy: no-referrer" header, and all the CDN sees is either a) nothing, because the client has the resource cached or b) a request for a certain version of jQuery without knowing where it came from. If you think this is a good idea because it enables technical enforcement, do you also want to ban static.example.com? Because if you don't, you'll soon have pointstothirdpartyadserver.example.com. If you do, you'll have https://example.com/proxytothirdpartyadserver/ https://example.com/proxytothirdpartyadserver/ instead... This is not a problem that can be completely solved on a technical level. Enforce the hell out of GDPR and see the problem shrink.

jraph 7y ago
It sounds like mitigating the CDN problem could be done like what the Decentraleyes browser addon does: replacing CDN hosted files by local versions. What are the difficulties for a browser to provide such a feature by default?
- tgsovlerkhgsel 7y ago
  You need to decide which CDN files to ship locally, you need to store them, do the initial fetching, etc. There is already a system for all of that. It's called the browser cache.