6

CDNs speed up the loading of websites by allowing caching for frequently used javascript libraries like jquery. How do we know if they have modified the javascript before serving it to my clients?

E.g. I have compared the hash of jquery.js and verified that it matches the hash on the official website. I then insert the link on my webpage. 2 week later, the CDN replaces it with a malicious copy with a keylogger embedded. When a client visits my webpage, the malicious script is downloaded and logs all input and posts it to their server.

Can I use a library like Crypto.JS to verify the md5 checksum of a script before executing it? This has to be done in javascript since the exploit works on the client side.

10

This is what you are looking for - Subresource Integrity:

Summary: http://qnimate.com/how-to-make-browsers-verify-fetched-resources-content/

Subresource integrity is only supported by the latest browsers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.