Replace insecure JS libraries

import { GlossaryTooltip, Tabs, TabItem, Steps, APIRequest, DashButton, } from "~/components";

This feature, when turned on, automatically rewrites URLs to external JavaScript libraries to point to Cloudflare-hosted libraries instead. This change improves security and performance, and reduces the risk of malicious code being injected.

This rewrite operation currently supports the polyfill JavaScript library hosted in polyfill.io.

:::caution

You may need to update your Content Security Policy (CSP) when turning on Replace insecure JavaScript libraries. The feature, when enabled, will not perform any URL rewrites if a CSP is present with a script-src or default-src directive. Cloudflare will not check report-only directives and it will not modify CSP headers.

Additionally, if you are defining a CSP via HTML meta tag, you must either turn off this feature or switch to a CSP defined in an HTTP header.

:::

How it works

When turned on, Cloudflare will check HTTP(S) proxied traffic for script tags with an src attribute pointing to a potentially insecure service and replace the src value with the equivalent link hosted under cdnjs.

:::caution Replace insecure JavaScript libraries modifies eligible HTML responses. Cloudflare may decompress and recompress the response. When the transformation runs, Cloudflare removes headers such as ETag and Content-Length. For more information, refer to Notes about end-to-end compression. :::

The rewritten URL will keep the original URL scheme (http:// or https://).

For polyfill.io URL rewrites, all 3.* versions of the polyfill library are supported under the /v3 path. Additionally, the /v2 path is also supported. If an unknown version is requested under the /v3 path, Cloudflare will rewrite the URL to use the latest 3.* version of the library (currently 3.111.0).

Availability

The feature is available in all Cloudflare plans, and is turned on by default on Free plans.

Configure

1. In the Cloudflare dashboard, go to the Security Settings page.

2. Turn Replace insecure JavaScript libraries on or off.

Issue a PATCH request similar to the following:

<APIRequest path="/zones/{zone_id}/settings/{setting_id}" parameters={{ setting_id: "replace_insecure_js", }} method="PATCH" json={{ value: "on", }} />

Final remarks

Since pages.dev zones are on a Free plan, the Replace insecure JavaScript libraries feature is turned on by default on these zones and it is not possible to turn it off.