5 ms·
If somebody has the ability to change the script file, what's to stop them from changing that hash, too?
by Skywing 12y ago
If somebody has the ability to change the script file, what's to stop them from changing that hash, too?
- adamtj 12y agoFor jquery, the page is often on your server and the script is on a CDN. The worry is that if an attacker compromises the jquery source on the CDN, they can exploit thousands or millions of sites on as many different servers. If each of those servers were serving pages with hashes, the modified jquery on the CDN would be rejected.
- Skywing 12y agoGood point. I was taking the parent's post literally, where jquery.com was used.
- 14113 12y agoIt's a solution for loading scripts from third party servers (e.g. jQuery), not from servers you control.