CDNs speed up the loading of websites by allowing caching for frequently used javascript libraries like jquery. How do we know if they have modified the javascript before serving it to my clients?

E.g. I have compared the hash of jquery.js and verified that it matches the hash on the official website. I then insert the link on my webpage. 2 week later, the CDN replaces it with a malicious copy with a keylogger embedded. When a client visits my webpage, the malicious script is downloaded and logs all input and posts it to their server.

Can I use a library like Crypto.JS to verify the md5 checksum of a script before executing it? This has to be done in javascript since the exploit works on the client side.

1 Answer 1


This is what you are looking for - Subresource Integrity:

Summary: http://qnimate.com/how-to-make-browsers-verify-fetched-resources-content/

Subresource integrity is only supported by the latest browsers.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .