Most of the modern applications are using CDN for third party libraries. For example, let's say I use xxxv2.min.js from cdn.example.com/xxxv2.min.js Everything is good, until the day that company has been hacked and their min.js file hijacked and injected some sort of script in it to get all the user cookies such as XSS.

To not leave the security of my application on someone else's hand (even though they are giant companies, for sure they are also bigger target than me for those bad guys!), I can use xxxv2.min.js locally but the trade off is performance here.

Can we make some sort of logic that basically still use the CDN but compares it with the local version of it with some sort of checksum or byte comparison? Or it is just overkill? What is the best way to use CDN securely, without relying the vendor's security protocols?

  • 4
    Subresource Integrity Apr 24, 2018 at 21:40
  • @AndrolGenhald sorry for my ignorance. That is exactly what I was looking for.
    – curiousBoy
    Apr 24, 2018 at 21:43
  • 1
    Stop doing useless and false obfuscation, use RFC2606. Apr 25, 2018 at 6:09
  • @patrick mevzek: what???
    – curiousBoy
    Apr 25, 2018 at 6:25
  • 2
    Use example.com and not xxxcompany.com as your choice is a bad placeholder (whatever name you choose you risk collisions; there are names put aside especially for documentation purposes) and that was my edit you decided to rollback. Please read rfc-editor.org/rfc/rfc2606.txt Apr 25, 2018 at 6:27

1 Answer 1


The security measures you are thinking of already exist. Take a look at this example from jQuery's CDN page:

<script src="http://code.jquery.com/jquery-3.3.1.min.js" integrity="sha256-FgpCb/KJQlLNfOu91ta32o/NMZxltwRo8QtmkMRdAu8=" crossorigin="anonymous"></script>

The notable part is the integrity="sha256-...", which a browser should check against the script to ensure the contents hash to the same value.

This defense is sufficient enough to mitigate your concerns, as an attacker can't modify the CDN script without it being detected. That is, unless you don't trust the website at all and the sha256 itself was placed by an attacker.

  • Thanks for you answer so it has to be provided by the third party CDN then correct?
    – curiousBoy
    Apr 24, 2018 at 21:45
  • 2
    Not necessarily, if they don't provide a hash or you don't trust the one provided, you could download the script, make sure it's not comprised, generate the hash, then insert it in your HTML like above. Apr 24, 2018 at 21:47
  • Make sure something as big as jQuery isn't compromised? The horror...
    – forest
    Apr 25, 2018 at 3:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .