Cross-Domain JavaScript Source File Inclusion

The Cross-Domain JavaScript Source File Inclusion alert means that the given page includes and potentially runs one or multiple Javascript files from a third-party domain.

If the external script location is not owned and managed by you there is a risk that the JavaScript file used by your application can be replaced with a malicious content that e.g. includes dangerous code or steals sensitive information/resources from your application users.

When some of your application JavaScript files are located on a third-party domain not managed by you the attacker may try to hijack that domain or access that third-party server to modify the files, so that your application will include a modified version that will be executed in web browsers of your users. This can be done without accessing your physical servers.

The general principle is to always host all your application files on server locations managed by you or a publicly trusted and recognized third-party service, e.g. CDN.

Our scanner looks for any inclusions of a JavaScript file from a third-party domain and reports the exact location of the imported files, so that the source and the related risk can be reviewed.