Why do websites need 3rd party scripts?
When developing a website, you’ll often include libraries to help speed up the development process, and avoid reinventing the wheel. However, there are times where you need to load a script from an external source. Due to recent attacks such as the Polyfill domain takeover, questions have been raised: why do you even need 3rd party scripts? How do they end up on a website?
Firstly, let’s set the stage. 3rd party scripts are JavaScript files served from a server other than your own. For example, suppose I run my website, cside.dev. This website was created by a team of developers, who used a number of libraries to put it together. This is then compiled / transformed / chunked into smaller, fewer JavaScript files than the source code originally was built up of. This is what we call 1st party JavaScript – it’s served as a resource inside of cside.dev, for example cside.dev/_next/static/chunks/main-ab76c1828cff9b09.js.
A week later, a marketing team member asks the developers to have a script added to the site for their analytics product of choice. Now, the site has its first 3rd-party JavaScript. This process can continue with the legal team asking for a cookie banner, marketing asking for another analytics script, so on and so forth.
