Security finding
A script from another host is loaded without an integrity hash
Security Warning Severity: Medium
Part of the audit Outdated and vulnerable libraries. Finding id: security.thirdPartyScriptWithoutIntegrity.
What it costs you
Whoever controls [host] controls what runs on your pages. If that host is taken over or the file is swapped, every visitor gets the new script, and nothing on your side notices.
What to do
Add an integrity hash to the script tag, or host the file on your own site.
What it checks
- Outside script loaded without a tamper check
How to fix it
Add the integrity attribute
- Use an address with an exact version in it, so the file does not change.
- Compute the hash: curl -s [src] | openssl dgst -sha384 -binary | openssl base64 -A
- Put sha384- and the result in the integrity attribute and add crossorigin="anonymous".
- On every upgrade of the library, compute the hash again.
How to check: Open [example url] with the browser console open: the script loads and there is no integrity error. Recrawl.
A real case
A chat tool from a third party on Ticketmaster's payment page exposed the payment details of up to 9.4 million customers in Europe; Barclays reported about 60,000 cards defrauded. The UK data protection regulator fined Ticketmaster 1.25 million pounds in November 2020.