Script integrity

Benson runs on your storefront, next to your checkout, so the code it serves has to be exactly the code it built. A script that third parties can change is a way into every store that loads it. Benson closes that off in three layers.

Every file is pinned by hash#

Your snippet loads one small file, benson.js. Everything else Benson runs comes after it, and every one of those files is pinned:

• benson.js loads Benson's core with a Subresource Integrity hash, the SHA-256 of the exact bytes that were built.
• The core pins every module it can load (the detector, the pop-up blocker, the widget and the rest) the same way. The modules pin the files they load in turn.
• Your browser checks each file against its hash before running it. A file that differs by a single byte is refused, and Benson carries on without it. Your store keeps working.

So if someone changed a module on our CDN, no shopper's browser would run it.

Code comes from one place#

The address Benson loads its code from is fixed when each release is published. It isn't a setting, and nothing in your site's configuration can change it. Your dashboard settings switch features on and off, but the files those features load always come from that one address, with the hashes they were built with.

That's why your Content Security Policy only needs two hosts, and why they never change.

The live copies are checked every two minutes#

benson.js is the one file that can't carry its own hash, because it's the file that holds all the others. It's covered a different way:

• Two separate providers serve a copy of benson.js: the CDN and Benson's API. Every two minutes Benson fetches every copy from inside its own network and checks they're byte for byte the same. It then walks the whole chain of files and checks each one against its pin.
• A second check runs every five minutes on its own, apart from the first, with its own alerts. If the first check ever stops, the second says so.
• If a copy differs, or a file doesn't match its pin, an alert goes to the team straight away. A brief difference during a release is normal, because the CDN is updated first. It only alerts if the copies still disagree after 30 minutes.

To change what your shoppers run without anyone noticing, someone would have to change both providers identically at the same moment.

Checking it yourself#

Open your store, open your browser's developer tools and look at the <script> tags Benson adds to the page. Each one has an integrity attribute holding the SHA-256 hash it must match. A file that fails the check shows as an integrity error in the console, and its code never runs.

What you don't need to do#

• Don't add an integrity attribute to your own snippet tag. benson.js changes with every release, so a fixed hash would switch Benson off at the next one. The checks above cover that file instead.
• Don't self-host Benson's files. A copy on your own server wouldn't receive fixes, and its chain of hashes would still point at Benson's CDN.