Third-party scripts

A script from another site runs with full access to your page.

What it is

Pages load analytics, widgets and libraries from other hosts. The browser runs them with the same rights as your own code.

Why it matters

If the other host is hacked or changes the file, your page runs the changed code. An integrity hash (integrity="sha384-...") makes the browser refuse a file that differs from the one you checked.

How Tenty checks it

Tenty reads this from the page and the script files every visitor receives. The check runs on every scan, and the finding names the place where it appears. Tenty lists script tags that load from another host and carry no integrity attribute.

How to fix it

Add integrity and crossorigin="anonymous" to the script tag, using a hash generated for the exact version. For analytics that change often, load them through your own host or a tag manager with limited rights.

How to reproduce

curl -sS 'https://YOUR-APP/' | grep -o '<script[^>]*src="https://[^>]*>'

Tags without an integrity attribute are the ones in the finding.