5 ms·
It seems like there could be some sort of cross origin cache header that could be set? That way by default you couldn't store in a global cache but server opera
by doctoboggan 5y ago
It seems like there could be some sort of cross origin cache header that could be set? That way by default you couldn't store in a global cache but server operators would be able to mark certain resources that could be.
- modeless 5y agoServer operators would just set that header on everything. There's no downside for them. The privacy issue only impacts users and it would still exist even if only a subset of libraries were shared.
- zdw 5y agoOne proposed solution is checksums on CDN provided javascript: https://w3c.github.io/webappsec-subresource-integrity/ https://w3c.github.io/webappsec-subresource-integrity/