A discussion about not sourcing JavaScript files from other websites (http://www.reddit.com/r/netsec/comments/29hfhz/please_dont_use_externally_hosted_javascript/) got me thinking.

Performance and cost reasons are mentioned that might make sense to have some scripts hosted by 3rd parties.


Is there an existing way to check referenced JavaScript (or maybe even images, other data) has not been changed by malicious actor?

From the top of my head, I'd say you might be able to do that with websockets to download the script and then check its hash, insert into HTML. Maybe. I do not recall any built-in solutions, like maybe <script src="https://foo/bar.js" hash="$5$0xf00...$0xbaa..."></script>.

  • Do you mean like a spoofed domain, or an untrusted domain? Jul 1 '14 at 16:33
  • No, I mean something like apis.google.com being compromised.
    – domen
    Jul 1 '14 at 16:36
  • Oh, well you could reverse proxy it from mysite.com/googleapi/, but at that point you aren't saving on bandwidth. More importantly though, that api link is blocked from the network I am currently on. So if you want to guarantee all of your content is accessible, have it all at least appear to be hosted from your domain. Jul 1 '14 at 17:01
  • I understand this doesn't answer your question on how to hash a js file. 1) I don't know and 2) I wouldn't do it even if I knew how. Jul 1 '14 at 17:02

There are no built-in solutions. (But there certainly should be!) You can indeed download the data using XMLHttpRequest 2 and then verify its hash using a JavaScript SHA-256 implementation before doing something with the result (e.g. evaling it, if it is JavaScript code). This will only work if the untrusted server supports CORS. The browser cache of the resource can still be used.

  • At which point, just host it yourself. Jul 1 '14 at 19:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.