{"id":13166,"date":"2026-09-27T07:35:00","date_gmt":"2026-09-27T05:35:00","guid":{"rendered":"https:\/\/www.lukaswojcik.com\/blog\/?p=13166"},"modified":"2026-10-26T12:11:33","modified_gmt":"2026-10-26T11:11:33","slug":"tutorial-reading-a-minified-third-party-script-before-it-goes-on-the-site","status":"publish","type":"post","link":"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/tutorials-en-web-development\/tutorial-reading-a-minified-third-party-script-before-it-goes-on-the-site\/","title":{"rendered":"Tutorial: Reading a Minified Third-Party Script Before It Goes on the Site"},"content":{"rendered":"<p>A third-party script executed directly in a page can access that page&#8217;s DOM and many browser APIs with the page&#8217;s privileges. The DOM is the browser\u2019s representation of the page, including text, forms and other elements. Browser boundaries still matter: cross-origin frames, HttpOnly cookies and permission-gated APIs are not simply unrestricted. The review must establish which integration context actually applies.<\/p>\n<p>Formatting and keyword searches are a useful first inspection. Six searches cannot establish every capability, prove harmlessness or replace a security review. A practical result is an evidence record: the exact file, candidate capabilities, observed behaviour, required endpoints and unresolved questions.<\/p>\n<h2>A reproducible copy before analysis<\/h2>\n<p>The following Bash example requires curl, sha256sum and an already installed, approved version of js-beautify. The reserved example URL needs the real vendor URL before use. A separate review directory keeps each dated snapshot intact. The download saves headers and the final URL, rejects HTTP errors and permits only HTTPS redirects; it does not execute the downloaded script.<\/p>\n<figure style=\"--cbb-digits:2\" class=\"cbb cbb--wrap cbb--numbers wp-block-code-beautifier-block-code\" data-lang=\"bash\"><figcaption class=\"cbb-head\"><span class=\"cbb-lang\">Shell<\/span><span class=\"cbb-actions\"><button type=\"button\" class=\"cbb-button cbb-button--wrap\" data-cbb-action=\"wrap\" aria-pressed=\"true\" title=\"Wrap long lines\"><svg aria-hidden=\"true\" focusable=\"false\" width=\"16\" height=\"16\" viewBox=\"0 0 16 16\"><path d=\"M2 4h12M2 8h9.5a2.5 2.5 0 0 1 0 5H8m0 0 1.5-1.5M8 13l1.5 1.5M2 12h3\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><\/svg><span class=\"cbb-sr\">Wrap long lines<\/span><\/button><button type=\"button\" class=\"cbb-button cbb-button--copy\" data-cbb-action=\"copy\" data-cbb-done=\"Copied\" data-cbb-failed=\"Press Ctrl+C to copy\"><svg aria-hidden=\"true\" focusable=\"false\" width=\"16\" height=\"16\" viewBox=\"0 0 16 16\"><rect x=\"5.5\" y=\"5.5\" width=\"8\" height=\"8.5\" rx=\"1.5\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.5\"\/><path d=\"M10.5 3.5V3A1.5 1.5 0 0 0 9 1.5H4A1.5 1.5 0 0 0 2.5 3v6.5A1.5 1.5 0 0 0 4 11h.5\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.5\"\/><\/svg><span class=\"cbb-button-label\" aria-live=\"polite\">Copy<\/span><\/button><\/span><\/figcaption><pre class=\"cbb-pre\" tabindex=\"0\"><code class=\"cbb-code language-bash\" style=\"counter-reset:cbb-line 0;\"><span class=\"cbb-line\"><span class=\"cbb-keyword\">set<\/span> <span class=\"cbb-attr\">-eu<\/span>\n<\/span><span class=\"cbb-line\"><span class=\"cbb-function\">curl<\/span> <span class=\"cbb-attr\">--fail<\/span> <span class=\"cbb-attr\">--show-error<\/span> <span class=\"cbb-attr\">--silent<\/span> <span class=\"cbb-attr\">--location<\/span>   \\\n<\/span><span class=\"cbb-line\">  <span class=\"cbb-attr\">--proto<\/span> <span class=\"cbb-string\">'=https'<\/span> <span class=\"cbb-attr\">--proto-redir<\/span> <span class=\"cbb-string\">'=https'<\/span>   \\\n<\/span><span class=\"cbb-line\">  <span class=\"cbb-attr\">--connect-timeout<\/span> <span class=\"cbb-number\">10<\/span> <span class=\"cbb-attr\">--max-time<\/span> <span class=\"cbb-number\">60<\/span>   \\\n<\/span><span class=\"cbb-line\">  <span class=\"cbb-attr\">--dump-header<\/span> widget.headers.txt   \\\n<\/span><span class=\"cbb-line\">  <span class=\"cbb-attr\">--write-out<\/span> <span class=\"cbb-string\">'%{url_effective}\\n'<\/span>   \\\n<\/span><span class=\"cbb-line\">  <span class=\"cbb-attr\">--output<\/span> widget.raw.js \\\n<\/span><span class=\"cbb-line\">  <span class=\"cbb-string\">'https:\/\/cdn.vendor.example\/widget.js'<\/span> <span class=\"cbb-operator\">&gt;<\/span> widget.final-url.txt\n<\/span><span class=\"cbb-line\"><span class=\"cbb-function\">test<\/span> <span class=\"cbb-attr\">-s<\/span> widget.raw.js\n<\/span><span class=\"cbb-line\">sha256sum widget.raw.js <span class=\"cbb-operator\">&gt;<\/span> widget.sha256\n<\/span><span class=\"cbb-line\">js-beautify <span class=\"cbb-attr\">--version<\/span>\n<\/span><span class=\"cbb-line\">js-beautify widget.raw.js <span class=\"cbb-attr\">-o<\/span> widget.pretty.js<\/span><\/code><\/pre><\/figure>\n<p>A successful download still needs a content and Content-Type check: an HTML login page with status 200 is not the expected JavaScript. The formatter version and retrieval time belong in the record. Raw bytes remain the reference for hashes; pretty-printing only aids reading. The difference in file size is not a security metric or a reliable measurement of network compression.<\/p>\n<p>Formatting cannot reconstruct original names, comments or source structure removed during a build. Source maps link positions in the delivered file to the original source code. Available maps can make inspection easier, but must correspond to the delivered file. DevTools can also save response content and export network records, so browser-based inspection can be documented. Captured URLs and payloads may contain data that needs removal before sharing.<\/p>\n<h2>Six searches for candidates<\/h2>\n<p>These examples find some common spellings. A match can be a comment or unused branch; no match does not exclude a capability. A script can call <code>globalThis[\"fe\" + \"tch\"](...)<\/code>, use an alias or load another file. The six categories organise review work rather than certify the script.<\/p>\n<figure style=\"--cbb-digits:2\" class=\"cbb cbb--wrap cbb--numbers wp-block-code-beautifier-block-code\" data-lang=\"bash\"><figcaption class=\"cbb-head\"><span class=\"cbb-lang\">Shell<\/span><span class=\"cbb-actions\"><button type=\"button\" class=\"cbb-button cbb-button--wrap\" data-cbb-action=\"wrap\" aria-pressed=\"true\" title=\"Wrap long lines\"><svg aria-hidden=\"true\" focusable=\"false\" width=\"16\" height=\"16\" viewBox=\"0 0 16 16\"><path d=\"M2 4h12M2 8h9.5a2.5 2.5 0 0 1 0 5H8m0 0 1.5-1.5M8 13l1.5 1.5M2 12h3\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><\/svg><span class=\"cbb-sr\">Wrap long lines<\/span><\/button><button type=\"button\" class=\"cbb-button cbb-button--copy\" data-cbb-action=\"copy\" data-cbb-done=\"Copied\" data-cbb-failed=\"Press Ctrl+C to copy\"><svg aria-hidden=\"true\" focusable=\"false\" width=\"16\" height=\"16\" viewBox=\"0 0 16 16\"><rect x=\"5.5\" y=\"5.5\" width=\"8\" height=\"8.5\" rx=\"1.5\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.5\"\/><path d=\"M10.5 3.5V3A1.5 1.5 0 0 0 9 1.5H4A1.5 1.5 0 0 0 2.5 3v6.5A1.5 1.5 0 0 0 4 11h.5\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.5\"\/><\/svg><span class=\"cbb-button-label\" aria-live=\"polite\">Copy<\/span><\/button><\/span><\/figcaption><pre class=\"cbb-pre\" tabindex=\"0\"><code class=\"cbb-code language-bash\" style=\"counter-reset:cbb-line 0;\"><span class=\"cbb-line\"><span class=\"cbb-comment\"># Network-related candidates<\/span>\n<\/span><span class=\"cbb-line\"><span class=\"cbb-function\">grep<\/span> <span class=\"cbb-attr\">-nE<\/span> <span class=\"cbb-string\">'fetch&#91;&#91;:space:&#93;&#93;*\\(|XMLHttpRequest|sendBeacon|WebSocket|EventSource|new&#91;&#91;:space:&#93;&#93;+Image'<\/span> widget.pretty.js\n<\/span><span class=\"cbb-line\"><span class=\"cbb-comment\"># Storage and cookie candidates<\/span>\n<\/span><span class=\"cbb-line\"><span class=\"cbb-function\">grep<\/span> <span class=\"cbb-attr\">-nE<\/span> <span class=\"cbb-string\">'localStorage|sessionStorage|cookie|indexedDB|caches'<\/span> widget.pretty.js\n<\/span><span class=\"cbb-line\"><span class=\"cbb-comment\"># Additional code or resource loading<\/span>\n<\/span><span class=\"cbb-line\"><span class=\"cbb-function\">grep<\/span> <span class=\"cbb-attr\">-nE<\/span> <span class=\"cbb-string\">'createElement|import&#91;&#91;:space:&#93;&#93;*\\(|importScripts|Worker|\\.src&#91;&#91;:space:&#93;&#93;*='<\/span> widget.pretty.js\n<\/span><span class=\"cbb-line\"><span class=\"cbb-comment\"># Input and form handling<\/span>\n<\/span><span class=\"cbb-line\"><span class=\"cbb-function\">grep<\/span> <span class=\"cbb-attr\">-nE<\/span> <span class=\"cbb-string\">'addEventListener|oninput|onkeydown|onsubmit|FormData|\\.value'<\/span> widget.pretty.js\n<\/span><span class=\"cbb-line\"><span class=\"cbb-comment\"># Device and rendering features<\/span>\n<\/span><span class=\"cbb-line\"><span class=\"cbb-function\">grep<\/span> <span class=\"cbb-attr\">-nE<\/span> <span class=\"cbb-string\">'getContext|toDataURL|AudioContext|hardwareConcurrency|RTCPeerConnection'<\/span> widget.pretty.js\n<\/span><span class=\"cbb-line\"><span class=\"cbb-comment\"># Literal HTTP(S) host candidates only<\/span>\n<\/span><span class=\"cbb-line\"><span class=\"cbb-function\">grep<\/span> <span class=\"cbb-attr\">-oiE<\/span> <span class=\"cbb-string\">'https?:\/\/&#91;a-z0-9.-&#93;+'<\/span> widget.pretty.js <span class=\"cbb-operator\">|<\/span> <span class=\"cbb-function\">sort<\/span> <span class=\"cbb-attr\">-u<\/span><\/span><\/code><\/pre><\/figure>\n<p>The storage search does not distinguish reads from writes. Session storage is not equivalent to indefinite persistence. Input handling requires a check of the actual element, event delegation, values read and later transmission. Canvas, audio or WebRTC use alone does not prove fingerprinting: feature tests and legitimate rendering are also possible. The purpose and data flow determine the finding.<\/p>\n<p>Consent cannot be decided by \u201cstorage plus transmission\u201d alone. Reading terminal information can matter without a new cookie, and a script with no keyword matches is not automatically a harmless rendering helper. The relevant purpose, access\/storage operations, personal data and applicable exemptions require a separate assessment; the EDPB guidance describes the technical scope beyond conventional cookies.<\/p>\n<figure class=\"lw-diagram\"><img src=\"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/diagrams\/dia-13166-thirdparty-20261025.png\" width=\"1120\" height=\"580\" loading=\"lazy\" decoding=\"async\" alt=\"Four complementary checks: preserved source, isolated behaviour tests, CSP resource rules and integrity checks.\"><figcaption>Search results are leads. No single check establishes all future script behaviour.<\/figcaption><\/figure>\n<h2>Minification and obfuscation<\/h2>\n<p>Minification reduces size, for example by removing whitespace and shortening internal names; obfuscation deliberately makes understanding harder. Encoded string tables, computed property names and dynamic code generation are review leads, not proof of malicious intent. Base64 decoding with <code>atob<\/code> has legitimate non-image uses. Conversely, dynamic property access can defeat a simple search without elaborate obfuscation.<\/p>\n<figure style=\"--cbb-digits:1\" class=\"cbb cbb--wrap wp-block-code-beautifier-block-code\" data-lang=\"bash\"><figcaption class=\"cbb-head\"><span class=\"cbb-lang\">Shell<\/span><span class=\"cbb-actions\"><button type=\"button\" class=\"cbb-button cbb-button--wrap\" data-cbb-action=\"wrap\" aria-pressed=\"true\" title=\"Wrap long lines\"><svg aria-hidden=\"true\" focusable=\"false\" width=\"16\" height=\"16\" viewBox=\"0 0 16 16\"><path d=\"M2 4h12M2 8h9.5a2.5 2.5 0 0 1 0 5H8m0 0 1.5-1.5M8 13l1.5 1.5M2 12h3\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><\/svg><span class=\"cbb-sr\">Wrap long lines<\/span><\/button><button type=\"button\" class=\"cbb-button cbb-button--copy\" data-cbb-action=\"copy\" data-cbb-done=\"Copied\" data-cbb-failed=\"Press Ctrl+C to copy\"><svg aria-hidden=\"true\" focusable=\"false\" width=\"16\" height=\"16\" viewBox=\"0 0 16 16\"><rect x=\"5.5\" y=\"5.5\" width=\"8\" height=\"8.5\" rx=\"1.5\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.5\"\/><path d=\"M10.5 3.5V3A1.5 1.5 0 0 0 9 1.5H4A1.5 1.5 0 0 0 2.5 3v6.5A1.5 1.5 0 0 0 4 11h.5\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.5\"\/><\/svg><span class=\"cbb-button-label\" aria-live=\"polite\">Copy<\/span><\/button><\/span><\/figcaption><pre class=\"cbb-pre\" tabindex=\"0\"><code class=\"cbb-code language-bash\" style=\"counter-reset:cbb-line 0;\"><span class=\"cbb-line\"><span class=\"cbb-function\">grep<\/span> <span class=\"cbb-attr\">-nE<\/span> <span class=\"cbb-string\">'eval&#91;&#91;:space:&#93;&#93;*\\(|Function&#91;&#91;:space:&#93;&#93;*\\(|atob&#91;&#91;:space:&#93;&#93;*\\(|String\\.fromCharCode|\\\\x&#91;0-9a-fA-F&#93;{2}'<\/span> widget.pretty.js<\/span><\/code><\/pre><\/figure>\n<p>Obfuscated code may still be analysed through decoding, source maps or specialist static analysis. An isolated runtime test provides another form of evidence, but only for the exercised paths. A test page should contain synthetic data and no active production accounts; an untrusted script should not be evaluated in an ordinary signed-in browser or on the production site merely to inspect behaviour.<\/p>\n<h2>Host candidates do not automatically become CSP rules<\/h2>\n<p>The host expression above deliberately finds only simple literal HTTP(S) prefixes. It misses relative addresses, protocol-relative URLs, WebSocket addresses, encoded strings and dynamically assembled destinations; it also drops port information. Comments and documentation URLs can produce irrelevant matches. A Content Security Policy (CSP) defines which sources the browser may use for scripts, connections and other resources. A useful endpoint inventory combines code context, actual requests, redirects and vendor documentation.<\/p>\n<p>Resource type determines the CSP directive: script loading, API connections and image requests are different operations. A host appearing in text is not sufficient reason to allow that host. The following report-only example illustrates a small fictitious site; the domains and reporting collector are placeholders, and the complete application policy needs its own review.<\/p>\n<figure style=\"--cbb-digits:1\" class=\"cbb cbb--wrap wp-block-code-beautifier-block-code\" data-lang=\"plain\"><figcaption class=\"cbb-head\"><span class=\"cbb-lang\">Text<\/span><span class=\"cbb-actions\"><button type=\"button\" class=\"cbb-button cbb-button--wrap\" data-cbb-action=\"wrap\" aria-pressed=\"true\" title=\"Wrap long lines\"><svg aria-hidden=\"true\" focusable=\"false\" width=\"16\" height=\"16\" viewBox=\"0 0 16 16\"><path d=\"M2 4h12M2 8h9.5a2.5 2.5 0 0 1 0 5H8m0 0 1.5-1.5M8 13l1.5 1.5M2 12h3\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><\/svg><span class=\"cbb-sr\">Wrap long lines<\/span><\/button><button type=\"button\" class=\"cbb-button cbb-button--copy\" data-cbb-action=\"copy\" data-cbb-done=\"Copied\" data-cbb-failed=\"Press Ctrl+C to copy\"><svg aria-hidden=\"true\" focusable=\"false\" width=\"16\" height=\"16\" viewBox=\"0 0 16 16\"><rect x=\"5.5\" y=\"5.5\" width=\"8\" height=\"8.5\" rx=\"1.5\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.5\"\/><path d=\"M10.5 3.5V3A1.5 1.5 0 0 0 9 1.5H4A1.5 1.5 0 0 0 2.5 3v6.5A1.5 1.5 0 0 0 4 11h.5\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.5\"\/><\/svg><span class=\"cbb-button-label\" aria-live=\"polite\">Copy<\/span><\/button><\/span><\/figcaption><pre class=\"cbb-pre\" tabindex=\"0\"><code class=\"cbb-code language-plain\" style=\"counter-reset:cbb-line 0;\"><span class=\"cbb-line\">Reporting-Endpoints: csp=\"https:\/\/reports.site.example\/csp\"\n<\/span><span class=\"cbb-line\">Content-Security-Policy-Report-Only: default-src 'self'; script-src 'self' https:\/\/cdn.vendor.example; connect-src 'self' https:\/\/api.vendor.example; img-src 'self' https:\/\/images.vendor.example; report-to csp<\/span><\/code><\/pre><\/figure>\n<p>Each header occupies one HTTP header line. The reporting endpoint must actually exist. Report-Only observes violations without blocking them; reports depend on browser support, delivery and executed paths. Missing reports are not proof of completeness, and a fixed week cannot cover every condition. Console and network observations remain part of the test.<\/p>\n<p>A host allowlist does not pin file contents. Another script from an already allowed host may load without a new host entry. With nonce\/hash trust and <code>'strict-dynamic'<\/code>, supported browsers can also allow dynamically loaded dependencies without separate host entries. CSP therefore does not close every gap left by an unchanged loader.<\/p>\n<h2>SRI pins the reviewed bytes<\/h2>\n<p>For a suitable stable script response, Subresource Integrity checks the bytes against an expected hash before execution. The hash must be generated from the reviewed raw file, not its formatted copy. This Python example prints the actual SHA-384 integrity value:<\/p>\n<figure style=\"--cbb-digits:1\" class=\"cbb cbb--wrap cbb--numbers wp-block-code-beautifier-block-code\" data-lang=\"python\"><figcaption class=\"cbb-head\"><span class=\"cbb-lang\">Python<\/span><span class=\"cbb-actions\"><button type=\"button\" class=\"cbb-button cbb-button--wrap\" data-cbb-action=\"wrap\" aria-pressed=\"true\" title=\"Wrap long lines\"><svg aria-hidden=\"true\" focusable=\"false\" width=\"16\" height=\"16\" viewBox=\"0 0 16 16\"><path d=\"M2 4h12M2 8h9.5a2.5 2.5 0 0 1 0 5H8m0 0 1.5-1.5M8 13l1.5 1.5M2 12h3\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><\/svg><span class=\"cbb-sr\">Wrap long lines<\/span><\/button><button type=\"button\" class=\"cbb-button cbb-button--copy\" data-cbb-action=\"copy\" data-cbb-done=\"Copied\" data-cbb-failed=\"Press Ctrl+C to copy\"><svg aria-hidden=\"true\" focusable=\"false\" width=\"16\" height=\"16\" viewBox=\"0 0 16 16\"><rect x=\"5.5\" y=\"5.5\" width=\"8\" height=\"8.5\" rx=\"1.5\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.5\"\/><path d=\"M10.5 3.5V3A1.5 1.5 0 0 0 9 1.5H4A1.5 1.5 0 0 0 2.5 3v6.5A1.5 1.5 0 0 0 4 11h.5\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.5\"\/><\/svg><span class=\"cbb-button-label\" aria-live=\"polite\">Copy<\/span><\/button><\/span><\/figcaption><pre class=\"cbb-pre\" tabindex=\"0\"><code class=\"cbb-code language-python\" style=\"counter-reset:cbb-line 0;\"><span class=\"cbb-line\"><span class=\"cbb-keyword\">import<\/span> base64\n<\/span><span class=\"cbb-line\"><span class=\"cbb-keyword\">import<\/span> hashlib\n<\/span><span class=\"cbb-line\"><span class=\"cbb-keyword\">from<\/span> pathlib <span class=\"cbb-keyword\">import<\/span> Path\n<\/span><span class=\"cbb-line\">\n<\/span><span class=\"cbb-line\">raw = <span class=\"cbb-function\">Path<\/span>(<span class=\"cbb-string\">\"widget.raw.js\"<\/span>).<span class=\"cbb-function\">read_bytes<\/span>()\n<\/span><span class=\"cbb-line\">digest = base64.<span class=\"cbb-function\">b64encode<\/span>(hashlib.<span class=\"cbb-function\">sha384<\/span>(raw).<span class=\"cbb-function\">digest<\/span>()).<span class=\"cbb-function\">decode<\/span>(<span class=\"cbb-string\">\"ascii\"<\/span>)\n<\/span><span class=\"cbb-line\"><span class=\"cbb-function\">print<\/span>(<span class=\"cbb-string\">\"sha384-\"<\/span> + digest)<\/span><\/code><\/pre><\/figure>\n<p>That complete output replaces the placeholder below. The placeholder is deliberately not a valid deployment hash.<\/p>\n<figure style=\"--cbb-digits:1\" class=\"cbb cbb--wrap cbb--numbers wp-block-code-beautifier-block-code\" data-lang=\"html\"><figcaption class=\"cbb-head\"><span class=\"cbb-lang\">HTML<\/span><span class=\"cbb-actions\"><button type=\"button\" class=\"cbb-button cbb-button--wrap\" data-cbb-action=\"wrap\" aria-pressed=\"true\" title=\"Wrap long lines\"><svg aria-hidden=\"true\" focusable=\"false\" width=\"16\" height=\"16\" viewBox=\"0 0 16 16\"><path d=\"M2 4h12M2 8h9.5a2.5 2.5 0 0 1 0 5H8m0 0 1.5-1.5M8 13l1.5 1.5M2 12h3\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><\/svg><span class=\"cbb-sr\">Wrap long lines<\/span><\/button><button type=\"button\" class=\"cbb-button cbb-button--copy\" data-cbb-action=\"copy\" data-cbb-done=\"Copied\" data-cbb-failed=\"Press Ctrl+C to copy\"><svg aria-hidden=\"true\" focusable=\"false\" width=\"16\" height=\"16\" viewBox=\"0 0 16 16\"><rect x=\"5.5\" y=\"5.5\" width=\"8\" height=\"8.5\" rx=\"1.5\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.5\"\/><path d=\"M10.5 3.5V3A1.5 1.5 0 0 0 9 1.5H4A1.5 1.5 0 0 0 2.5 3v6.5A1.5 1.5 0 0 0 4 11h.5\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.5\"\/><\/svg><span class=\"cbb-button-label\" aria-live=\"polite\">Copy<\/span><\/button><\/span><\/figcaption><pre class=\"cbb-pre\" tabindex=\"0\"><code class=\"cbb-code language-html\" style=\"counter-reset:cbb-line 0;\"><span class=\"cbb-line\"><span class=\"cbb-punct\">&lt;<\/span><span class=\"cbb-tag\">script<\/span> <span class=\"cbb-attr\">src<\/span><span class=\"cbb-punct\">=<\/span><span class=\"cbb-string\">\"https:\/\/cdn.vendor.example\/widget.js\"<\/span>\n<\/span><span class=\"cbb-line\">        <span class=\"cbb-attr\">integrity<\/span><span class=\"cbb-punct\">=<\/span><span class=\"cbb-string\">\"sha384-REPLACE_WITH_REVIEWED_BASE64_DIGEST\"<\/span>\n<\/span><span class=\"cbb-line\">        <span class=\"cbb-attr\">crossorigin<\/span><span class=\"cbb-punct\">=<\/span><span class=\"cbb-string\">\"anonymous\"<\/span><span class=\"cbb-punct\">&gt;<\/span><span class=\"cbb-punct\">&lt;\/<\/span><span class=\"cbb-tag\">script<\/span><span class=\"cbb-punct\">&gt;<\/span><\/span><\/code><\/pre><\/figure>\n<p>A different response fails the integrity check. The application needs a defined response to that failure, rather than an automatic update to whatever hash the vendor currently serves. Cross-origin SRI also requires a suitable CORS response. <code>crossorigin=\"anonymous\"<\/code> uses CORS with same-origin credentials mode: cross-origin credentials are omitted, while same-origin credentials can still be sent.<\/p>\n<p>A changing tag container is not mathematically incompatible with hashing. In practice, dynamic or personalised responses, missing CORS support and frequent publications can make stable SRI deployment unsuitable or unsupported by the vendor. Where pinning is unavailable, publication controls, reviewed versions and monitoring remain necessary. None of those controls certifies arbitrary future code.<\/p>\n<div class=\"lw-faq\">\n<h2>Questions and answers<\/h2>\n<h3>Does the loader&#8217;s hash cover every dependency?<\/h3>\n<p>No. The hash on a script element covers the fetched resource for that element, not every subsequently loaded script or configuration response. A dynamically created script can carry its own integrity metadata when the loader supports that. Each dependency otherwise needs separate assessment; a permitted host alone is not an integrity guarantee.<\/p>\n<h3>Does an unchanged weekly hash prove unchanged behaviour?<\/h3>\n<p>No. Identical bytes can behave differently because of remote configuration, time, location, consent, account state or changing dependencies. A changed hash is a review signal, not a verdict. The comparison schedule should reflect the integration&#8217;s update process and risk, while runtime tests cover relevant conditions.<\/p>\n<h3>What belongs in an update review?<\/h3>\n<ol><li>A new raw snapshot with retrieval evidence, alongside the previous accepted version.<\/li><li>A contextual comparison of code, endpoint candidates and dependencies; minifier changes can make line diffs noisy.<\/li><li>Isolated tests for the relevant pages, consent states and interactions, with network and storage observations.<\/li><li>A documented decision for each new destination or capability before changing CSP or the accepted integrity value.<\/li><\/ol>\n<p>Server-side use, retention and onward sharing cannot be established from browser code alone. Those questions need vendor evidence and the applicable contractual documentation. A technical review makes the questions concrete; it does not independently verify the vendor&#8217;s entire processing chain.<\/p>\n<\/div>\n<div class=\"lw-quellen\"><h2>Sources<\/h2><ul><li><a href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/JavaScript\">MDN: JavaScript documentation<\/a><\/li><li><a href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/JavaScript\/Reference\/Operators\/Property_accessors\">MDN: JavaScript property accessors<\/a><\/li><li><a href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/Security\/Defenses\/Same-origin_policy\">MDN: Same-origin policy<\/a><\/li><li><a href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/API\/Document\/cookie\">MDN: Document.cookie<\/a><\/li><li><a href=\"https:\/\/developer.chrome.com\/docs\/devtools\/javascript\/source-maps\">Chrome DevTools: Debug original code with source maps<\/a><\/li><li><a href=\"https:\/\/developer.chrome.com\/docs\/devtools\/network\/reference\">Chrome DevTools: Network features reference<\/a><\/li><li><a href=\"https:\/\/github.com\/beautifier\/js-beautify\">js-beautify: Project documentation and CLI<\/a><\/li><li><a href=\"https:\/\/curl.se\/docs\/manpage.html\">curl: Command-line manual<\/a><\/li><li><a href=\"https:\/\/www.edpb.europa.eu\/system\/files\/2024-10\/edpb_guidelines_202302_technical_scope_art_53_eprivacydirective_v2_en_0.pdf\">EDPB: Guidelines 2\/2023, technical scope of Article 5(3), version 2.0<\/a><\/li><li><a href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/HTTP\/Reference\/Headers\/Content-Security-Policy\/script-src\">MDN: Content-Security-Policy script-src<\/a><\/li><li><a href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/HTTP\/Reference\/Headers\/Content-Security-Policy-Report-Only\">MDN: Content-Security-Policy-Report-Only<\/a><\/li><li><a href=\"https:\/\/www.w3.org\/TR\/CSP3\/\">W3C: Content Security Policy Level 3<\/a><\/li><li><a href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/Security\/Defenses\/Subresource_Integrity\">MDN: Subresource Integrity<\/a><\/li><li><a href=\"https:\/\/www.w3.org\/TR\/sri\/\">W3C: Subresource Integrity<\/a><\/li><li><a href=\"https:\/\/html.spec.whatwg.org\/multipage\/urls-and-fetching.html#cors-settings-attributes\">WHATWG HTML: CORS settings attributes<\/a><\/li><\/ul><\/div>\n","protected":false},"excerpt":{"rendered":"<p>A structured review combines preserved source files, targeted searches, isolated behaviour tests, CSP rules and integrity checks. Search results provide leads; missing matches do not prove that a function is absent.<\/p>\n","protected":false},"author":1,"featured_media":29416,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[158],"tags":[91312,91219,91315,91115],"class_list":["post-13166","post","type-post","status-publish","format-standard","hentry","category-tutorials-en-web-development","tag-javascript","tag-tutorial","tag-web-performance","tag-web-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Tutorial: Reading a Minified Third-Party Script Before It Goes on the Site | Lukas Wojcik<\/title>\n<meta name=\"description\" content=\"Beautifying a vendor script, the six patterns worth searching for, extracting its host list for a CSP, and why pinning fails for a tag container.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/tutorials-en-web-development\/tutorial-reading-a-minified-third-party-script-before-it-goes-on-the-site\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Tutorial: Reading a Minified Third-Party Script Before It Goes on the Site | Lukas Wojcik\" \/>\n<meta property=\"og:description\" content=\"Beautifying a vendor script, the six patterns worth searching for, extracting its host list for a CSP, and why pinning fails for a tag container.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/tutorials-en-web-development\/tutorial-reading-a-minified-third-party-script-before-it-goes-on-the-site\/\" \/>\n<meta property=\"og:site_name\" content=\"Lukas Wojcik - Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-27T05:35:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-26T11:11:33+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/11\/flux-voll-13166-13166.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Lukas Wojcik\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Lukas Wojcik\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/web-development\\\/tutorials-en-web-development\\\/tutorial-reading-a-minified-third-party-script-before-it-goes-on-the-site\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/web-development\\\/tutorials-en-web-development\\\/tutorial-reading-a-minified-third-party-script-before-it-goes-on-the-site\\\/\"},\"author\":{\"name\":\"Lukas Wojcik\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\"},\"headline\":\"Tutorial: Reading a Minified Third-Party Script Before It Goes on the Site\",\"datePublished\":\"2026-09-27T05:35:00+00:00\",\"dateModified\":\"2026-10-26T11:11:33+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/web-development\\\/tutorials-en-web-development\\\/tutorial-reading-a-minified-third-party-script-before-it-goes-on-the-site\\\/\"},\"wordCount\":1292,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\"},\"image\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/web-development\\\/tutorials-en-web-development\\\/tutorial-reading-a-minified-third-party-script-before-it-goes-on-the-site\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/flux-voll-13166-13166.png\",\"keywords\":[\"JavaScript\",\"Tutorial\",\"Web Performance\",\"Web Security\"],\"articleSection\":[\"Tutorials\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/web-development\\\/tutorials-en-web-development\\\/tutorial-reading-a-minified-third-party-script-before-it-goes-on-the-site\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/web-development\\\/tutorials-en-web-development\\\/tutorial-reading-a-minified-third-party-script-before-it-goes-on-the-site\\\/\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/web-development\\\/tutorials-en-web-development\\\/tutorial-reading-a-minified-third-party-script-before-it-goes-on-the-site\\\/\",\"name\":\"Tutorial: Reading a Minified Third-Party Script Before It Goes on the Site | Lukas Wojcik\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/web-development\\\/tutorials-en-web-development\\\/tutorial-reading-a-minified-third-party-script-before-it-goes-on-the-site\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/web-development\\\/tutorials-en-web-development\\\/tutorial-reading-a-minified-third-party-script-before-it-goes-on-the-site\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/flux-voll-13166-13166.png\",\"datePublished\":\"2026-09-27T05:35:00+00:00\",\"dateModified\":\"2026-10-26T11:11:33+00:00\",\"description\":\"Beautifying a vendor script, the six patterns worth searching for, extracting its host list for a CSP, and why pinning fails for a tag container.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/web-development\\\/tutorials-en-web-development\\\/tutorial-reading-a-minified-third-party-script-before-it-goes-on-the-site\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/web-development\\\/tutorials-en-web-development\\\/tutorial-reading-a-minified-third-party-script-before-it-goes-on-the-site\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/web-development\\\/tutorials-en-web-development\\\/tutorial-reading-a-minified-third-party-script-before-it-goes-on-the-site\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/flux-voll-13166-13166.png\",\"contentUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/flux-voll-13166-13166.png\",\"width\":1200,\"height\":630,\"caption\":\"Tutorial: Reading a Minified Third-Party Script Before It Goes on the Site\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/web-development\\\/tutorials-en-web-development\\\/tutorial-reading-a-minified-third-party-script-before-it-goes-on-the-site\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Tutorial: Reading a Minified Third-Party Script Before It Goes on the Site\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/\",\"name\":\"Lukas Wojcik - Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\",\"name\":\"Lukas Wojcik\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"contentUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"width\":424,\"height\":636,\"caption\":\"Lukas Wojcik\"},\"logo\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\"},\"sameAs\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Tutorial: Reading a Minified Third-Party Script Before It Goes on the Site | Lukas Wojcik","description":"Beautifying a vendor script, the six patterns worth searching for, extracting its host list for a CSP, and why pinning fails for a tag container.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/tutorials-en-web-development\/tutorial-reading-a-minified-third-party-script-before-it-goes-on-the-site\/","og_locale":"en_US","og_type":"article","og_title":"Tutorial: Reading a Minified Third-Party Script Before It Goes on the Site | Lukas Wojcik","og_description":"Beautifying a vendor script, the six patterns worth searching for, extracting its host list for a CSP, and why pinning fails for a tag container.","og_url":"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/tutorials-en-web-development\/tutorial-reading-a-minified-third-party-script-before-it-goes-on-the-site\/","og_site_name":"Lukas Wojcik - Blog","article_published_time":"2026-09-27T05:35:00+00:00","article_modified_time":"2026-10-26T11:11:33+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/11\/flux-voll-13166-13166.png","type":"image\/png"}],"author":"Lukas Wojcik","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Lukas Wojcik","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/tutorials-en-web-development\/tutorial-reading-a-minified-third-party-script-before-it-goes-on-the-site\/#article","isPartOf":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/tutorials-en-web-development\/tutorial-reading-a-minified-third-party-script-before-it-goes-on-the-site\/"},"author":{"name":"Lukas Wojcik","@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9"},"headline":"Tutorial: Reading a Minified Third-Party Script Before It Goes on the Site","datePublished":"2026-09-27T05:35:00+00:00","dateModified":"2026-10-26T11:11:33+00:00","mainEntityOfPage":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/tutorials-en-web-development\/tutorial-reading-a-minified-third-party-script-before-it-goes-on-the-site\/"},"wordCount":1292,"commentCount":0,"publisher":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9"},"image":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/tutorials-en-web-development\/tutorial-reading-a-minified-third-party-script-before-it-goes-on-the-site\/#primaryimage"},"thumbnailUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/11\/flux-voll-13166-13166.png","keywords":["JavaScript","Tutorial","Web Performance","Web Security"],"articleSection":["Tutorials"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/tutorials-en-web-development\/tutorial-reading-a-minified-third-party-script-before-it-goes-on-the-site\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/tutorials-en-web-development\/tutorial-reading-a-minified-third-party-script-before-it-goes-on-the-site\/","url":"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/tutorials-en-web-development\/tutorial-reading-a-minified-third-party-script-before-it-goes-on-the-site\/","name":"Tutorial: Reading a Minified Third-Party Script Before It Goes on the Site | Lukas Wojcik","isPartOf":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/tutorials-en-web-development\/tutorial-reading-a-minified-third-party-script-before-it-goes-on-the-site\/#primaryimage"},"image":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/tutorials-en-web-development\/tutorial-reading-a-minified-third-party-script-before-it-goes-on-the-site\/#primaryimage"},"thumbnailUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/11\/flux-voll-13166-13166.png","datePublished":"2026-09-27T05:35:00+00:00","dateModified":"2026-10-26T11:11:33+00:00","description":"Beautifying a vendor script, the six patterns worth searching for, extracting its host list for a CSP, and why pinning fails for a tag container.","breadcrumb":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/tutorials-en-web-development\/tutorial-reading-a-minified-third-party-script-before-it-goes-on-the-site\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/tutorials-en-web-development\/tutorial-reading-a-minified-third-party-script-before-it-goes-on-the-site\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/tutorials-en-web-development\/tutorial-reading-a-minified-third-party-script-before-it-goes-on-the-site\/#primaryimage","url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/11\/flux-voll-13166-13166.png","contentUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/11\/flux-voll-13166-13166.png","width":1200,"height":630,"caption":"Tutorial: Reading a Minified Third-Party Script Before It Goes on the Site"},{"@type":"BreadcrumbList","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/tutorials-en-web-development\/tutorial-reading-a-minified-third-party-script-before-it-goes-on-the-site\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.lukaswojcik.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Tutorial: Reading a Minified Third-Party Script Before It Goes on the Site"}]},{"@type":"WebSite","@id":"https:\/\/www.lukaswojcik.com\/blog\/#website","url":"https:\/\/www.lukaswojcik.com\/blog\/","name":"Lukas Wojcik - Blog","description":"","publisher":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.lukaswojcik.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9","name":"Lukas Wojcik","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","contentUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","width":424,"height":636,"caption":"Lukas Wojcik"},"logo":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg"},"sameAs":["https:\/\/www.lukaswojcik.com\/blog"]}]}},"_links":{"self":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts\/13166","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/comments?post=13166"}],"version-history":[{"count":5,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts\/13166\/revisions"}],"predecessor-version":[{"id":26805,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts\/13166\/revisions\/26805"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/media\/29416"}],"wp:attachment":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/media?parent=13166"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/categories?post=13166"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/tags?post=13166"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}