0

Scenario: I don't want to serve the Facebook/Meta Pixel to my users but let's say I load dozens of scripts and CDN content from third parties. Can one of those third parties insert the Meta / Facebook Pixel into my page and would it work?

I fully understand the danger of loading any third party scripts to my site and that if I have an untrusted content provider, Meta Pixel "is the least of my problems", but I want to find out if it is possible for a third party to insert a Facebook / Meta Pixel.

2 Answers 2

1

Any script included directly into a HTML page via a script tag has full access to the DOM of the current page and can modify it at will. This includes adding code to include images from other sites and thus also third-party tracking pixels like the Meta/Facebook pixel.

0

Typically, any JavaScript loaded can modify the page however it likes. That can result in loading images, JavaScript, and tracking pixels; creating cookies; and pretty much anything else that your own JavaScript can do.

If you want to restrict this, you can use Subresource Integrity. In such a case, you pin your dependencies to a specific version and include a hash of that particular resource (script or stylesheet) in your web page. Only a resource exactly matching that hash can be loaded; otherwise, the browser rejects loading it.

If you restrict the resources to trusted ones and you audit the resources you load, then you can have confidence that the resources you're using are the ones you intended, and that they don't do anything you don't approve of. This is a best practice, since it prevents the kind of malicious tampering you're concerned about.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .