Hacker News Reader

Historically that was a major security issue. It’s less of an issue now that SRI exists (you’re using SRI, right?), but it’s still a problem when you have a broken pathway to the CDN but your site loads OK. Well, assuming you’re not building with progressive enhancement. You’re building with progressive enhancement right?

View on HN

sorry what is SRI ?

Subresource Integrity. It’s designed specifically for this scenario: a resource included into your page from a seperate server that could potentially be compromised. Your hash the known good resource and include that hash in your script or link tags as an integrity attribute. When the user’s browser downloads the resource it’ll hash it again and check for a match. Only if the two match will it parse and execute the contents.

https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

Reply on news.ycombinator.com