Most of the modern applications are using CDN for third party libraries. For example, let's say I use
Everything is good, until the day that company has been hacked and their
min.js file hijacked and injected some sort of script in it to get all the user cookies such as XSS.
To not leave the security of my application on someone else's hand (even though they are giant companies, for sure they are also bigger target than me for those bad guys!), I can use
xxxv2.min.js locally but the trade off is performance here.
Can we make some sort of logic that basically still use the CDN but compares it with the local version of it with some sort of checksum or byte comparison? Or it is just overkill? What is the best way to use CDN securely, without relying the vendor's security protocols?