3 ms·
> That's what subresource integrity is for. Only the parent page needs HTTPS Once you have already opened a TLS connection for the parent page, you might as we
by bawolff 3y ago
> That's what subresource integrity is for. Only the parent page needs HTTPS
Once you have already opened a TLS connection for the parent page, you might as well keep using it. You've already paid for it, and that way you get confidentiality in addition to integrity.
P.S. because nobody actually answered. Hashes like what SRI uses are quantum safe.
- littlestymaar 3y agoYou're missing the point: it's essentially about third party dependencies/assets (say a popular framework from a CDN), and here you cannot reuse the TLS connection. Also, using HTTPS to connect to the third party doesn't prevent tempering on the third party's side, that's what SRI is for.
- bawolff 3y agoOf course you can just not do that, and then problem solved. Historically there is some performance benefit of using a separate CDN, as browsers would share the cache. However modern browsers do not do that. I suppose in theory the CDN might be geo-distributed to be very close to your user, however it seems like the latency of opening a second connection (esp. In http/2 world) would likely outweigh that unless your web server is really bad.
- hinkley 3y agoCloudfront and cloudflare can both present edge cached resources as from the origin domain can’t they? Akamai did not as I recall but that may have changed after I stopped needing to care about them.
- hinkley 3y agoThird party resources are a bane to my existence as a web user and as a person responsible for page load time. I would cry some big fat crocodile tears if that feature got removed. It’s already been curtailed a bit.
- hinkley 3y agoHTTP 3 tries to amortize that handshake across more requests.