I'm apprehensive to the idea of a cached version of X for Y based on the hash value (could be secure but assuming eventual collisions in SHA-256 it wouldn't be

I'm apprehensive to the idea of a cached version of X for Y based on the hash value (could be secure but assuming eventual collisions in SHA-256 it wouldn't be hard to setup a poisoned copy of a library that would live on for a long time). An alternative use of this would be to validate the script that is being downloaded from the remote source. If you're delegating to Google or any other CDN for a javascript library you really expect it to be the one you requested. Assuming you're not pointing at the HEAD/latest version versus a specific (which would already be pretty amateur for a real site) then you expect it to always be exactly the same (ex: jquery-1.8.1.min.js should always be the same file ... if a bug is fixed it's a new version). It'd be a security improvement to have a way to have the browser verify that. <script src="https://some-cdn.example.com/some-library-1.2.3.js https://some-cdn.example.com/some-library-1.2.3.js hash="[secure hash of contents]"> If the downloaded file's hash does not match the expected one then the browser would flag a security warning or simply not load the file.