Re:The Baseline Costs of JavaScript Frameworks
by robin_reala on Wednesday November 28, 2018 @11:45AM
(#18553035)
Historically that was a major security issue. It’s less of an issue now that SRI exists (you’re using SRI, right?), but it’s still a problem when you have a broken pathway to the CDN but your site loads OK. Well, assuming you’re not building with progressive enhancement. You’re building with progressive enhancement right?
[ Parent
| on HN ]
Re:The Baseline Costs of JavaScript Frameworks
by hleszek on Wednesday November 28, 2018 @12:11PM
(#18553288)
sorry what is SRI ?
Re:The Baseline Costs of JavaScript Frameworks
by robin_reala on Wednesday November 28, 2018 @12:34PM
(#18553520)
Subresource Integrity. It’s designed specifically for this scenario: a resource included into your page from a seperate server that could potentially be compromised. Your hash the known good resource and include that hash in your script or link tags as an integrity attribute. When the user’s browser downloads the resource it’ll hash it again and check for a match. Only if the two match will it parse and execute the contents.
https://developer.mozilla.org/en-US/docs/Web/Security/Subres...