title: Specifying the hash of a script from an untrusted host
body: <p>Is there any implementation or specification for including a hash or signature in an attribute of a &lt;script> tag, so that the browser can verify that the correct file was retrieved before executing it? Something like:</p>
  
  <pre class="lang-html prettyprint-override"><code>&lt;script
    src="http://cdn.example.com/jquery-2001.js"
    signature="sha-256/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
  &gt;&lt;/script&gt;
  </code></pre>
  
  <p>The motivation is this: generally, each additional CDN or host you use for your site increases your vulnerability, by adding a new target that can be hacked to compromise your site. Allowing your primary front-end servers to assert hashes or signatures of those files could entirely eliminate that risk, allowing you to be more flexible when designing your architecture. You could even request missing files from an untrusted peer-to-peer network.</p>
  
  <p>I thought I remembered a specification about this, but haven't been able to find it.</p>