3 ms·

You could specify that you expect the referenced resource to be served with a given ETag. Would that be good enough?

• litewulf 18y ago
  ETags can be arbitrary, the server can put whatever it wants.
  • jbert 18y ago
    Ah, yes. An attacker could fetch the resource themselves, discover the ETag and serve their malicious resource with the real ETag. Sorry.