How to check the integrity of loaded Javascript code

Question

I run a Bitcoin wallet that uses browser side Javascript to encrypt and decrypt Bitcoin keys.

I want to make the javascript available for scrutiny on Github, and then load the javascript from the github repository.

My problem is I need to check the integrity of the loaded Javascript to ensure at hasn't been tampered with at Github.

How can I best do this ? Would it be something like.

Load remote Javascript with an ajax call.
MD5 hash and compare.
If in good shape execute it.

Couldn't the client mess with the checksum computing function itself? — Anirudh Ramanathan
– Anirudh Ramanathan, Commented Mar 18, 2013 at 15:01
Maybe store your code on another server. A CDN that only you can access. That way you can be sure it's fine. — gen_Eric
– gen_Eric, Commented Mar 18, 2013 at 15:01
How crucial is this at the point of checking if client-side? I'm pretty sure you know client-side is not safe in practically any way. The integrity check really must be done by a server-side script and then feed it back to the JavaScript, otherwise you will face immense security problematics. — user1467267
– user1467267, Commented Mar 18, 2013 at 15:02
Anything that runs in a browser can be tampered with. Either directly or scripts loaded with an extension or add on. — datasage
– datasage, Commented Mar 18, 2013 at 15:02
I'm pretty sure that using github as a CDN is explicitly discouraged. — Pointy
– Pointy, Commented Mar 18, 2013 at 15:02

DmitryK · Accepted Answer · 2015-06-07 13:24:21Z

6

There is (or soon WILL be) an elegant way to achieve this now (2 years after the question was asked).

http://www.w3.org/TR/SRI/

You can now specify the "integrity" parameter inside the script tag:

<script src="https://github.com/<path>/yourscript.js"
        integrity="sha256-SDf......">

This won't work for the script loaded via an AJAX requests. But you can potentially reference scripts as script tags pointing at the CDN (ideally not at github directly)

answered Jun 7, 2015 at 13:24

DmitryK

5,5921 gold badge25 silver badges32 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

How to check the integrity of loaded Javascript code

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related