Using A JavaScript CDN That Can Not XSS You - With Subresource Int...
summary
Proposes using subresource integrity to stop compromised CDNs from injecting XSS by verifying exact hash digests (sha256/384/512) before execution, shows the actual integrity attribute plus crossorigin="anonymous" and explains how browsers check multiple digests, failover patterns and developer recovery (local fallback when hash fails). Covers implementation status (nightly builds, flags), toolchain gaps (gulp/npm support missing), and limits (streaming media, canonicalization issues) with prototype behavior demonstrated and practical deployment tradeoffs.
AI-written summary · about
chapters (16)
- 0:00Start
- 1:26Content Delivery Networks
- 2:22The Same-Origin Policy
- 3:08The Same Origin Policy
- 5:12one vulnerability is enough
- 7:19Subresource Integrity to the Rescue
- 9:56Reading Cross-Origin Data?
- 11:08Cross Origin Resource Sharing (CORS)
- 13:13The Fineprint
- 16:21over HTTP or HTTPS?
- 17:20Failover
- 18:05Future Work
- 20:47We need your help!
- 22:19Conclusion
- 22:42Extending the Web is non-trivial
- 22:55Browser Security needs to step up (and will)
related talks
59mThe Final Frontier: Security APIs in Modern Browsers
58mFixing XSS with Content Security Policy
18mWriting an (in)secure webapp
23mJavaScript attack surface
24mWe're struggling to keep up
47mD2T2 - Defense-in-Depth Techniques for Modern Web Apps
16m7 web technologies you might not know yet
41mWeb Security