4 ms·

Any updates on adding integrity checking to the script? Makes it a bit worrisome to embed it on sites otherwise.

• bhouston 3y ago
  Check the homepage: https://web3dsurvey.com https://web3dsurvey.com Instead of direct JavaScript includes I now recommend just putting it in an iframe and I share example code on the homepage. This lets me still update the script while also ensuring it can not access cookies or other things in the main page context. What do you think?
  • capableweb 3y ago
    The point of the integrity hash is to be able to include a remote resource after reviewing and verifying it, and then being sure it doesn't change to do other things automagically, that you haven't reviewed before it runs on your users browser. Wrapping the script tag in a iframe does not accomplish this as far as I can tell.
    • bhouston 3y ago
      Right. But the main attack vector of a raw JavaScript include into the main page is that it can access anything you are doing in that page include logins or secrets or cookies or other private data. Moving it into an iframe sandboxes it and reduces the majority of nefarious things it can do. Especially if it is running off of web3dsurvey in the iframe and not the host website origin - thus a bunch of cross origin protections kick in. So the iframe sandbox deals with the security issue is a different fashion. Also the iframe can not block the main pages so it has even less impact on the main page experience. This is as secure now as the majority of ads served on the web.