third-party scripts

Managing third-party scripts safely: inventory, SRI, CSP and form destinations

A third-party script can read the page it runs on, including what users type. If the provider is compromised or the file changes, your users are affected even though your own server was never touched. The defense, in order: list everything that runs, remove what you do not need, add SRI to fixed files or serve a reviewed copy yourself, restrict sources and destinations with CSP, and check for changes on a schedule. CSP form-action does not fall back to default-src, so set it explicitly.