The JavaScript Supply Chain Paradox: SRI, CSP and Trust in Third Party Libraries
The JavaScript Supply Chain Paradox: SRI, CSP and Trust in Third Party Libraries A couple of years back as the US presidential campaign was ramping up, the Trump camp did something stupid. I know, we're all shocked but bear with me because it's an important part of the narrative of this post. One of their developers embedded this code in the campaign's donation website: <script src="https://github
署名式 SRI(Subresource Integrity)の議論 - ASnoKaze blog
W3CのWeb Application Securityワーキンググループで、署名式 SRIの議論が出ていたので簡単に書く 背景 セキュリティ向上の目的で、Webページ上で読み込まれるリソース(JavaScript等)を制限する方法に、CSP(Content Security Policy)やSRI(Subresource Integrity)と言った技術がある。 CSP CSPを利用することで、読み込むJavaScriptを信頼できるURLのみに制限出来る。 CSPのscript-srcディレクティブで、以下のように制限できる。 script-src https://example.com/script/trusted.js しかし、CSP Is Dead, Long Live CSP! On the Insecurity of Whitelists and the Future of
SRI Hash Generator
What is Subresource Integrity? SRI is a new W3C specification that allows web developers to ensure that resources hosted on third-party servers have not been tampered with. Use of SRI is recommended as a best-practice, whenever libraries are loaded from a third-party source. Learn more about how to use subresource integrity on MDN. How is Subresource Integrity different to HTTPS? TLS ensures that
148363 – Implement Subresource Integrity (SRI)
Note You need to log in before you can comment on or make changes to this bug. The SRI specification "defines a mechanism by which user agents may verify that a fetched resource has been delivered without unexpected manipulation" using a validation scheme and "extending several HTML elements with an integrity attribute that contains a cryptographic hash of the representation of the resource the au
Do not let your CDN betray you: Use Subresource Integrity – Mozilla Hacks - the Web developer blog
Mozilla Firefox Developer Edition 43 and other modern browsers help websites to control third-party JavaScript loads and prevent unexpected or malicious modifications. Using a new specification called Subresource Integrity, a website can include JavaScript that will stop working if it has been modified. With this technology, developers can benefit from the performance gains of using Content Delive
OWASP San Diego 8 August 2015 Presentation (Public)
Where Content Security Policy Is and Where It's Heading Next Open Web Platform Security Joel Weinberger jww@{chromium.org,google.com} @metromoxie Originally, I was going to present what’s up and coming in Content Security Policy, but really, what we’ve been working on goes well past just CSP. So ...
Integrity protection for third-party JavaScript
Modern web applications depend on a lot of auxiliary scripts which are often hosted on third-party CDNs. Should an attacker be able to tamper with the files hosted on such a CDN, millions of sites could be compromised. Web developers need a way to guarantee the integrity of scripts hosted elsewhere. This is the motivation behind a new addition to the web platform being introduced by the W3C: sub-r
[PDF] A CDN that can not XSS you Using Subresource Integrity
A CDN that can not XSS you Using Subresource Integrity about:frederik Frederik Braun Security Engineer at Mozilla fbraun@mozilla.com https://frederik-braun.com @freddyb Why am I here? https://www.mozilla.org/en-US/about/manifesto/ Content Delivery Networks <script src="https://code.jquery.com/jquery-2.1.4.min.js"></script> <link href='http://fonts.googleapis.com/css?family=PT+Sans…' rel='styleshe
1
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
