On the Integrity of Cross-Origin JavaScripts

TL;DR

This paper empirically studies the temporal integrity of cross-origin JavaScript on popular websites, revealing frequent changes, low adoption of security standards, and the potential for predicting integrity shifts to enhance web security.

Contribution

It provides the first empirical analysis of cross-origin JavaScript integrity over time, highlighting security challenges and the early stage of subresource integrity adoption.

Findings

Temporal integrity changes are common in cross-origin scripts.

Subresource integrity standard adoption remains limited.

It is possible to statistically predict integrity changes.

Abstract

The same-origin policy is a fundamental part of the Web. Despite the restrictions imposed by the policy, embedding of third-party JavaScript code is allowed and commonly used. Nothing is guaranteed about the integrity of such code. To tackle this deficiency, solutions such as the subresource integrity standard have been recently introduced. Given this background, this paper presents the first empirical study on the temporal integrity of cross-origin JavaScript code. According to the empirical results based on a ten day polling period of over 35 thousand scripts collected from popular websites, (i) temporal integrity changes are relatively common; (ii) the adoption of the subresource integrity standard is still in its infancy; and (iii) it is possible to statistically predict whether a temporal integrity change is likely to occur. With these results and the accompanying discussion, the paper contributes to the ongoing attempts to better understand security and privacy in the current Web.