5 ms·
I've wondered in the past why there isn't something like: <script src="https://elsewhere.example.com" digest="<SHA-$foo>" /> that refuses to load the refe
by shabble 13y ago
I've wondered in the past why there isn't something like:
<script src="https://elsewhere.example.com" digest="<SHA-$foo>" />
that refuses to load the referenced script unless it matches the specified digest/signature.
Using anything from sources you don't trust is a bad idea, but even trustworthy partners can be exploited to attack your site as well.
It would mean coordinating updates of the digest to all referencing sites though, which might make it practically impossible.
- jerf 13y ago"It would mean coordinating updates of the digest to all referencing sites though, which might make it practically impossible." You just put the version number in the name somewhere and make deployments immutable. Otherwise you have everything you need for that already, technically, though you might want to add a fallback to a local clone of the resource or something so it isn't just a failure.
- aggieben 13y agoit wouldn't be all that hard to implement this yourself if you're willing to load script dynamically. you'd have to maintain your own digest list.