security/sri-cdn

Dlaczego

A script from a CDN runs with the full rights of your page. If the CDN or the package is compromised, every site that loads the file runs the attacker's code. With an integrity hash, the browser refuses a file that changed.

Poprawka

Add integrity="sha384-…" (the hash the CDN or openssl dgst -sha384 -binary file | openssl base64 -A gives) and crossorigin="anonymous". Better: install the package and let the build bundle it, so it is served from your origin. URLs without a fixed version (tag managers, latest) cannot use SRI; keep them to a minimum.

Przykłady

<!-- bad -->
<script src="https://code.jquery.com/jquery-3.7.1.min.js"></script>
<!-- good -->
<script src="https://code.jquery.com/jquery-3.7.1.min.js" integrity="sha384-…" crossorigin="anonymous"></script>

Źródła

• MDN, Subresource Integrity
• W3C, Subresource Integrity

Przeczytaj w terminalu

npx github:dawidolko/frontend-skills explain security/sri-cdn