4 ms·
Given the number of websites that rely on jQuery and other hosted JavaScript libraries, I can't believe there isn't yet a well-publicized way of verifying exter
by Kortaggio 12y ago
Given the number of websites that rely on jQuery and other hosted JavaScript libraries, I can't believe there isn't yet a well-publicized way of verifying external scripts before loading them. If someone managed to compromise a jQuery CDN, we're looking at a Heartbleed-level vulnerability in terms of scale and impact.
I've never seen the hash attr before. Is this an experimental feature that is already available on live browsers, or only a proposal?
- ryan-c 12y agoIt's a proposal. I made this thing: https://github.com/ryancdotorg/VerifyJS https://github.com/ryancdotorg/VerifyJS but it requires CORS headers from the CDN and isn't well tested.