4 ms·

You're in luck! There's a working group called "Subresource Integrity" that's developing a way to allow websites to restrict a resource (including javascript fi

• deanclatworthy 12y ago
  This is a step in the right direction for embedding external resources. It'd remove CDNs as an attack vector (once it's rolled out everywhere). It'd be great to come up with some kind of way to also tell the client what resources are expected, and if a new one is loaded (e.g. <iframe src="http://dangerous.malware.com"></iframe> http://dangerous.malware.com"></iframe>) the client would not even connect to it.