&gt; The first would seem preferable though, as loading from an external source would expose the user to cross-site tracking.<p>You&#x27;re right in that the first one you had with just the sha-256 would be pretty much equivalent as what I had especially given that hn readers have resoundingly given support to the idea that it is non-trivial to create a malicious file with the same hash as our script file. I was simply trying to be cautious and retain some control for the web application (even if the extra sense of security is misplaced).<p>This is the use case I&#x27;m trying to protect by adding a new &quot;canonical&quot; reference that the web application decides. As others in this thread have said, it is very unlikely that someone will be able to craft a malicious script with the same hash as what I already have. The reason I still stand by including both is firstly compatibility (I hope browsers can simply ignore the sha-256 hash and the authorized cache links if they don&#x27;t know what to do with it).<p>As a noscript user, I do not want to trust y0l0swagg3r cdn (just giving an example, please forgive me if this is your company name). NoScript blocks everything other than a select whitelist. If the CDN happens to be blocked, my website should still continue to function loading the script from my server.<p>My motivation here was to allow perhaps even smaller companies to sort of pool their common files into their own cdn? &lt;script src=&quot;jimaca.js&quot; authoritative-cache-provider=&quot;<a href="https:&#x2F;&#x2F;cdn.jimacajs.example.com&#x2F;v1&#x2F;12&#x2F;34&#x2F;jimaca.js&quot;&quot;&gt;&lt;&#x2F;script&gt;" rel="nofollow">https:&#x2F;&#x2F;cdn.jimacajs.example.com&#x2F;v1&#x2F;12&#x2F;34&#x2F;jimaca.js&quot;&quot;&gt;&lt;&#x2F;scri...</a> I also want to avoid a situation where Microsoft can come to me and tell me that I can&#x27;t name my js files microsoft.js or something. The chances of an accidental collision are apparently very close to zero so I agree with you that there is room for improvement. (:<p>This is definitely not an RFC or anything formal. I am just a student and in no position to actually effect any change or even make a formal proposal.