OWASPASVS 5.0 requirement
ASVS-V3.6.1 Client-side assets, such as javascript libraries, css, or web fonts, are only hosted externally (e.g., on a content delivery network) if…
- Standard
- OWASP ASVS 5.0
- Chapter
- V3 Web Frontend Security
- Section
- V3.6 External Resource Integrity
- Level
- L3 (requirement applies from this verification level up)
Requirement
Verify that client-side assets, such as JavaScript libraries, CSS, or web fonts, are only hosted externally (e.g., on a Content Delivery Network) if the resource is static and versioned and Subresource Integrity (SRI) is used to validate the integrity of the asset. If this is not possible, there should be a documented security decision to justify this for each resource.