CDNs speed up the loading of websites by allowing caching for frequently used javascript libraries like jquery. How do we know if they have modified the javascript before serving it to my clients?
E.g. I have compared the hash of jquery.js and verified that it matches the hash on the official website. I then insert the link on my webpage. 2 week later, the CDN replaces it with a malicious copy with a keylogger embedded. When a client visits my webpage, the malicious script is downloaded and logs all input and posts it to their server.
Can I use a library like Crypto.JS to verify the md5 checksum of a script before executing it? This has to be done in javascript since the exploit works on the client side.
