I am researching about the 3rd party tools to use in a project, and I haven't found any conclusive evidence about this:
Is it better* to include 3rd party scripts with a <script>
tag or to host them locally? Where better means it will likely affect to a smaller number of users.
I was able to find the best security practices for each case, but not information about which one is a better practice. These are the main pros/cons as a difference that I could find for an external script:
- The 3rd party hacked: all their clients are vulnerable now.
- Automatic security update: all the clients are secure now.
Setting up the integrity
tag seems a lot more similar to self-hosting as you are locked to a specific version. Also, if the host is down then their script is down. So from a security point of view, an external script with a checksum seems to be equally secure, with more downtime.
So it really seems to boil down to how much you trust the 3rd party updates to be benign or malicious AND what is your company response time.
My thinking is, if you have a 24/7 security response team, actively monitor all your 3rd parties AND do a security assessment of any new code then it might make sense to actually host it yourself to reduce the risk of them being hacked (while increasing response time). Otherwise, it makes more sense to let the company host it, since their response time will be much lower than the combination of their response time + the company response time.
So, what is the industry standard? Is there any official recommendation?
Edit: I did find some alarmist blog posts urging not to use 3rd party <script>
tags, but all of them invariably failed to acknowledge the security benefit of having your script hosted by its company creator.
Edit2: This is a nice write-up that indirectly touches on the advantages/disadvantages of 3rd party scripts: "If you are using 3rd party scripts make sure to examine them and their postMessage implementation" && "I reached out to Matt Abrams (AddThis CTO) who made sure a fix was quickly implemented and pushed to end users".