<story><title>Do not let your CDN betray you: Use Subresource Integrity</title><url>https://hacks.mozilla.org/2015/09/subresource-integrity-in-firefox-43/</url></story><parent_chain><item><author>dspillett</author><text>This could also be used to remove the need for a CDN for common libraries like jquery and similar resources. If the browser knows it has a file in its cache with the same properties (has, size, name) even if it come from a different site it can be pretty sure that the content is the same so no new request is needed.&lt;p&gt;So your site could use the cached copy of jquery (for instance) that was originally brought down to serve my site, or vice versa.</text></item></parent_chain><comment><author>bugmen0t</author><text>We&amp;#x27;ve been toying with this idea in earlier revisions of the spec, basically using the hash as a cache key and not loading the same file from websiteB if it has already been loaded form websiteA.&lt;p&gt;Unfortunately, this could be used as a cache poisoning attack to bypass Content Security Policy.&lt;p&gt;See the section about &amp;quot;Content addressable storage&amp;quot; at &amp;lt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;frederik-braun.com&amp;#x2F;subresource-integrity.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;frederik-braun.com&amp;#x2F;subresource-integrity.html&lt;/a&gt;&amp;gt;.&lt;p&gt;(If you can come up with a magical solution to this problem, join the W3C web application security group mailing list and send us an email.)</text></comment>
<story><title>Do not let your CDN betray you: Use Subresource Integrity</title><url>https://hacks.mozilla.org/2015/09/subresource-integrity-in-firefox-43/</url></story><parent_chain><item><author>dspillett</author><text>This could also be used to remove the need for a CDN for common libraries like jquery and similar resources. If the browser knows it has a file in its cache with the same properties (has, size, name) even if it come from a different site it can be pretty sure that the content is the same so no new request is needed.&lt;p&gt;So your site could use the cached copy of jquery (for instance) that was originally brought down to serve my site, or vice versa.</text></item></parent_chain><comment><author>sidarape</author><text>&amp;gt; size, name&lt;p&gt;I don&amp;#x27;t see why it would be necessary to provide a name and a size. If the hash is the same, we can be pretty sure that&amp;#x27;s the same file.</text></comment>