Skip to main content
O
osgood_
Legend
January 15, 2017
Answered

Monstrosity links???

  • January 15, 2017
  • 2 replies
  • 1765 views

Just for laughs can anyone inform me why we are now being fed monstrosity links like below?

<script src="https://code.jquery.com/jquery-3.1.1.js" integrity="sha256-16cdPddA6VdVInumRGo6IbivbERE8p7CQR3HzTBuELA=" crossorigin="anonymous"></script>

Instead of:

<script src="https://code.jquery.com/jquery-3.1.1.js"></script>

I assume they must serve some kind of purpose.

Os

    This topic has been closed for replies.
    Correct answer Nancy OShea

    Yes. it's important.  It's called an INTEGRITY attribute and it's there in case the CDN is ever  hacked or goes malicious.

    Integrity is a flag that can be included in script-tags that specify the hash of an accepted script.   If the script on the server does not match the hash,  the end user’s web browser will reject it  This reduces potential risk for everyone.   These days, very important.

    Crossorgin is also required for Integrity checking.  It stops credentials from being sent with the request.

    Nancy

    2 replies

    pziecina
    pziecina
    Legend
    January 15, 2017

    One other thing that Nancy did not mention -

    Browsers are starting to implement 'warnings' about any scripts that are from a different server than the original, without the 'integrity/origin' attribute. This is how they are 'behind the scenes' implementing html5 ad blocking.

    Nancy OShea
    Community Expert
    Nancy OSheaCommunity ExpertCorrect answer
    Community Expert
    January 15, 2017

    Yes. it's important.  It's called an INTEGRITY attribute and it's there in case the CDN is ever  hacked or goes malicious.

    Integrity is a flag that can be included in script-tags that specify the hash of an accepted script.   If the script on the server does not match the hash,  the end user’s web browser will reject it  This reduces potential risk for everyone.   These days, very important.

    Crossorgin is also required for Integrity checking.  It stops credentials from being sent with the request.

    Nancy

    Nancy O'Shea— Product User & Community Expert
    O
    osgood_Author
    Legend
    January 15, 2017

    This still works, without all the garbage, whats the risk to me?

    <script src="https://code.jquery.com/jquery-3.1.1.js"></script>

    Rob Hecker2
    Rob Hecker2
    Legend
    January 16, 2017

    Rob Hecker2 wrote:

    Personally I would not want to put myself in the situation where I was responsible for the up-keep of a server because things do happen and I would lose too much sleep worrying about it. I dont know if the financial rewards in doing so out-weight that concern.

    The financial rewards of managing the server are what allowed me to purchase a Bentley. . . .oh wait; I guess I don't actually own a Bentley.

    I admit that sometimes it's a headache and a lot of work. very little of which can be billed to clients. Originally, I had to reasons for going this route:

    1. It allows one to not have to learn the idiosyncrasies of every podunk webhost admin system clients might already be using.
    2. It allows one to protect code you write from theft and meddling.
    3. It allows one to control over server resources such as bandwidth and processing power.

    Later, I appreciated the ability to control the server environment, such as the ability to control the PHP configuration, loaded extensions, etc.

    I think all those points are good points but not enough for me personally to want to take on the responsibily of managing and fixing a webserver if it goes wrong or is hacked.

    I have to focus my attentions on areas which I understand and are fully in my control so I can confidentally offer a service to a client without fear of not being able to resolve issues when things go pear shaped.

    That's just me, I play safe.


    I agree. We each have to focus on certain areas, forgoing others.

    That's why I quickly got out of updating website content and moved to a CMS. I really hated updating website content.

      Terms & ConditionsAccessibility statement
      Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices