I'm looking for some standard pieces of advice on how to integrate external JavaScript into a website. For example, on mywebsite.com
:
<script src='//externalsite.com/js/script.js'></script>
The thing is: if externalsite.com
gets hacked, mywebsite.com
is at risk. And this JavaScript does not require access to the mywebsite.com
content (it is for example a chatbox).
What would be the right way to do it? Is iFrame the way to go?
To clarify, the JS is a virtual assistant that "chats" with the visitor. The externalsite is managing the JS code, and more importantly the dialogs. I'm woried about XSS in the dialogs.