Subresource Integrity hashes [1] should let sites get the caching and CDN benefit of using shared resources like jquery without letting 3rd parties have the abi

Subresource Integrity hashes [1] should let sites get the caching and CDN benefit of using shared resources like jquery without letting 3rd parties have the ability to XSS them. Basically, you can specify a hash of what the url should point to, and if it doesn't match then the load is blocked. This isn't quite out yet: it's in Chrome trunk [2] and still under review in Firefox [3]. [1] https://w3c.github.io/webappsec/specs/subresourceintegrity/ https://w3c.github.io/webappsec/specs/subresourceintegrity/ [2] https://code.google.com/p/chromium/issues/detail?id=355467 https://code.google.com/p/chromium/issues/detail?id=355467 [3] https://bugzilla.mozilla.org/show_bug.cgi?id=992096 https://bugzilla.mozilla.org/show_bug.cgi?id=992096