Post

wouldn't it be nice if sites could share a cache of common js? ... stuff like react, or vue or svelte? 👉 there's an early stage proposal for cross-origin storage which enables exactly this. there are challenges but I think it's very interesting indeed

github.comGitHub - WICG/cross-origin-storage: Explainer for the Cross-Origin Storage (COS) APIExplainer for the Cross-Origin Storage (COS) API. Contribute to WICG/cross-origin-storage development by creating an account on GitHub.

We used to have this many years ago by default. It was common to load jQuery et al from a public CDN so most people wouldn't have to download it again just for your site. Then marketers started using it to fingerprint. And hackers used it to poison cross-origin JS. The feature got removed sigh

Due to the way caches are domain sharded for privacy, it doesn’t really work that well. Caches aren’t as effective as people had hoped. That, and a third party takeover of a CDN is too bigger security risk for most websites

This attack would not be possible with COS because it's hash-based. Say you expect jQuery 1.2.3 with hash def456 and good-become-evil dot com /jquery1_2_3.js suddenly serves a modified resource, then said resource would not be allowed in the COS cache for the hash mismatch.