> In these global dragnet surveillance ridden times it should be a no-brainer but please don't expose your visitors to third-party websites, respect their privacy, host your assets yourself.
I still wish there was a "hash" attribute to script tags (and others) so that browsers could cache common JS/CSS/etc assets cross-domain.
Re:CDN for JavaScript libraries
by woadwarrior01 on Monday June 23, 2014 @08:18AM
(#7931480)
I've been wanting this for a while now.
The common argument against this is that this enables cache poisoning attacks where an attacker can craft malicious files with matching hashes.
But I think the security it offers against CDNs turning rogue makes it worthwhile. Here's the draft proposal https://github.com/pwnall/script-digest
Ugh. This proposal also suggests using "magic comments" in scripts, which needs to die. They will get stripped by things like pagespeed and various acceleration proxies, completely outside the developers control.
shouldn't it be something like <script src="blah" data-hash-sha512="...">?
Re:CDN for JavaScript libraries
by jacobgreenleaf on Monday June 23, 2014 @10:52AM
(#7932243)
If the hash was SHA-512 wouldn't that be hard?
Agreed, especially a third party provide of javascript! It would be absolutely trivial for them to inject highly invasive tracking code into your site, or worse.
I'm not saying they will, but really it doesn't make sense to take the risk.
I think the assets are served via cookie less connection.
prasanth:~/ $ http get http://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.1/jquery.min.js [18:22:12]
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
CF-Cache-Status: HIT
CF-RAY: 13f0d5579cd70bab-HKG
Cache-Control: public, max-age=30672000
Connection: keep-alive
Content-Encoding: gzip
Content-Type: application/javascript
Date: Mon, 23 Jun 2014 12:54:17 GMT
Expires: Sat, 13 Jun 2015 12:54:17 GMT
Last-Modified: Thu, 01 May 2014 17:45:11 GMT
Server: cloudflare-nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding
Re:CDN for JavaScript libraries
by terinjokes on Monday June 23, 2014 @02:58PM
(#7933777)
CloudFlare WWW developer here: since that thread we fixed our GA inserts on our web properties and turned off the usual CDN cookies for CDNJS.
In these global dragnet surveillance ridden times it should be a no-brainer but please don't expose your visitors to third-party websites, respect their privacy, host your assets yourself.