How to ensure the third party CDN is secure (and stays secure)?

Question

Most of the modern applications are using CDN for third party libraries. For example, let's say I use xxxv2.min.js from cdn.example.com/xxxv2.min.js Everything is good, until the day that company has been hacked and their min.js file hijacked and injected some sort of script in it to get all the user cookies such as XSS.

To not leave the security of my application on someone else's hand (even though they are giant companies, for sure they are also bigger target than me for those bad guys!), I can use xxxv2.min.js locally but the trade off is performance here.

Can we make some sort of logic that basically still use the CDN but compares it with the local version of it with some sort of checksum or byte comparison? Or it is just overkill? What is the best way to use CDN securely, without relying the vendor's security protocols?

Answer 1

The security measures you are thinking of already exist. Take a look at this example from jQuery's CDN page:

<script src="http://code.jquery.com/jquery-3.3.1.min.js" integrity="sha256-FgpCb/KJQlLNfOu91ta32o/NMZxltwRo8QtmkMRdAu8=" crossorigin="anonymous"></script>

The notable part is the integrity="sha256-...", which a browser should check against the script to ensure the contents hash to the same value.

This defense is sufficient enough to mitigate your concerns, as an attacker can't modify the CDN script without it being detected. That is, unless you don't trust the website at all and the sha256 itself was placed by an attacker.