Major sites running unauthenticated JavaScript on their payment pages

Re:Major sites running unauthenticated JavaScript on their p... by jszymborski on Thursday November 29, 2018 @08:53AM (#18560117)

You are totally right, but I'm wondering if we shouldn't change this practice. I'm starting to think if you're making a call to an external service, it should be proxied through your network.

It'd increase bandwidth/latency, but you can be assured that the network calls your page are making are hitting the correct 3rd parties, and even inspect to see that the payloads are "correct".

Edit: Surely, this at the very least should be the case for payment pages and banking websites.

[ Parent | on HN ]

Re:Major sites running unauthenticated JavaScript on their p... by asaph on Thursday November 29, 2018 @09:06AM (#18560200)

> ... but you can be assured that the network calls your page are making are hitting the correct 3rd parties ...

The browser's sandbox security model already does this for us with the same origin policy.

> ... and even inspect to see that the payloads are "correct".

This is what SRI already does for us.

[ Parent | on HN ]

Re:Major sites running unauthenticated JavaScript on their p... by jszymborski on Thursday November 29, 2018 @09:23AM (#18560302)

To the second point, I was thinking of checking what came over the wire after AJAX calls from 3rd party JS (which may or may not have been loaded with SRI).

I'll have to concede the first point... I was thinking that you can whitelist entire URLs to be fetched as opposed to domains, but on second thought, I don't think that'd be a meaningful change.

Thanks, this has made me think a lot more on this, however :)

[ Parent | on HN ]