16 ms·
> Because otherwise how do you know when they suddenly change their script to do something entirely different? https://developer.mozilla.org/en-US/docs/Web/Sec
by the8472 6y ago
> Because otherwise how do you know when they suddenly change their script to do something entirely different?
https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
- magicalhippo 6y agoNot bad, but as far as I can see it requires you are _really_ sure no further scripts are dynamically loaded. Or is there a way for the server to specify all resources must have SRI?
- thecopy 6y agoYes, by using CSP
- magicalhippo 6y agoNice, at least it's possible.
- the8472 6y agohttps://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co... You can combine CSP it with SRI hashes and also report violations to the backend.