-2

Most of the modern applications are using CDN for third party libraries. For example, let's say I use xxxv2.min.js from cdn.example.com/xxxv2.min.js Everything is good, until the day that company has been hacked and their min.js file hijacked and injected some sort of script in it to get all the user cookies such as XSS.

To not leave the security of my application on someone else's hand (even though they are giant companies, for sure they are also bigger target than me for those bad guys!), I can use xxxv2.min.js locally but the trade off is performance here.

Can we make some sort of logic that basically still use the CDN but compares it with the local version of it with some sort of checksum or byte comparison? Or it is just overkill? What is the best way to use CDN securely, without relying the vendor's security protocols?

  • 4
    Subresource Integrity – AndrolGenhald Apr 24 '18 at 21:40
  • @AndrolGenhald sorry for my ignorance. That is exactly what I was looking for. – curiousBoy Apr 24 '18 at 21:43
  • 1
    Stop doing useless and false obfuscation, use RFC2606. – Patrick Mevzek Apr 25 '18 at 6:09
  • @patrick mevzek: what??? – curiousBoy Apr 25 '18 at 6:25
  • 2
    Use example.com and not xxxcompany.com as your choice is a bad placeholder (whatever name you choose you risk collisions; there are names put aside especially for documentation purposes) and that was my edit you decided to rollback. Please read rfc-editor.org/rfc/rfc2606.txt – Patrick Mevzek Apr 25 '18 at 6:27
7

The security measures you are thinking of already exist. Take a look at this example from jQuery's CDN page:

<script src="http://code.jquery.com/jquery-3.3.1.min.js" integrity="sha256-FgpCb/KJQlLNfOu91ta32o/NMZxltwRo8QtmkMRdAu8=" crossorigin="anonymous"></script>

The notable part is the integrity="sha256-...", which a browser should check against the script to ensure the contents hash to the same value.

This defense is sufficient enough to mitigate your concerns, as an attacker can't modify the CDN script without it being detected. That is, unless you don't trust the website at all and the sha256 itself was placed by an attacker.

  • Thanks for you answer so it has to be provided by the third party CDN then correct? – curiousBoy Apr 24 '18 at 21:45
  • 2
    Not necessarily, if they don't provide a hash or you don't trust the one provided, you could download the script, make sure it's not comprised, generate the hash, then insert it in your HTML like above. – multithr3at3d Apr 24 '18 at 21:47
  • Make sure something as big as jQuery isn't compromised? The horror... – forest Apr 25 '18 at 3:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.