Thank you for great widget. Easy to integrate and understand. We have recently integrated the Elfsight LinkedIn Feed into our Drupal website.
We were asked to implement Subresource Integrity (SRI) to verify the integrity of the third-party JavaScript loaded from the Elfsight CDN. We have added the SHA-384 integrity hash, but we understand that if the contents of platform.js change during an Elfsight update, the hash will need to be updated to prevent the browser from blocking the script.
How can we avoid this? Any recommendations or documentation would be greatly appreciated.
I am really happy that you enjoy the LinkedIn Feed widget. Thanks a lot for your kind words!
As for you question, the platform.js file is updated occasionally, so we don’t recommend using SRI. Any update would invalidate the hash and prevent the widget from loading.
To avoid this, we recommend removing the integrity attribute from the script tag.
Please let me know if this explains things or if you have any questions left
Thanks Max for replying, We understand that the platform.js file is updated occasionally and that using SRI may cause the widget to stop working when the hash changes.
However, according to cybersecurity assessment requires us to address the risk associated with loading third-party JavaScript without integrity verification. So its mandatory for us to add integrity key.
Would you recommend downloading the platform.js file and hosting it locally on our website, or is there another approach you would suggest?
We also want to ensure that any solution we adopt complies with Elfsight’s guidelines and terms of use.
I completely understand your concerns regarding third-party script integrity and the need to comply with your organization’s security policies.
Unfortunately, we don’t recommend using SRI with platform.js, as the file is updated periodically, which would invalidate the integrity hash and prevent the widget from loading.
As for downloading and hosting platform.js locally, this is technically possible, but we don’t recommend this approach either. Future platform updates may cause the widget to stop working correctly, so you would need to maintain and update the locally hosted file yourself.
At the moment, we don’t have an alternative solution that would meet your SRI requirements while ensuring the widget continues to work reliably.
I’m sorry we couldn’t offer a better solution in this case. I’ll be happy to share your feedback with our team for future consideration.
