0

The site seal provided by GoDaddy uses HTML code like:

<span id="siteseal"><script async type="text/javascript" src="https://seal.godaddy.com/getSeal?sealID=QbDnMaazFIO7w9NOAcnMvsbUtqu5vnUGH3pUNkBBkGMcUA1vaEhbNbYr2PKh"></script></span>

As our site has thousands of HTML pages, we prefer not to embed the HTML script in each page to avoid re-embedding a new code once the HTTPS certificate expires. So we used JavaScript to insert the GoDaddy into each page, which successfully displays the site seal without any noticeable problems. But we want to make sure this method of inserting the site seal is "safe"/has no security issues instead of using the provided standard code itself. The JavaScript code used is this:

(function(){
var siteSeal = document.createElement("script");
siteSeal.type = "text/javascript";
siteSeal.async = true;
siteSeal.src = "https://seal.godaddy.com/getSeal?sealID=QbDnMaazFIO7w9NOAcnMvsbUtqu5vnUGH3pUNkBBkGMcUA1vaEhbNbYr2PKh";

var siteSealSpan = document.createElement("span");
siteSealSpan.id = "siteseal";
siteSealSpan.setAttribute("style","margin-top:.25rem");
siteSealSpan.appendChild(siteSeal);

var siteSealLi = document.createElement("li");
siteSealLi.appendChild(siteSealSpan);

var siteSealLoc = document.getElementById("footer-list");
if (siteSealLoc) {
    siteSealLoc.appendChild(siteSealLi);
}
})();
1
  • Somebody voted to close this question and migrate it to StackOverflow. I don't think this question is appropriate for SO. The code in this question is the code they are given. They are not asking to change it or fix it, which is the type of questions that SO likes. Nov 14, 2018 at 15:12

1 Answer 1

2

You can never be 100% sure that anything is safe and secure. It is probably fine to use GoDaddy's site seal JavaScript as long as you trust GoDaddy.

When you put JavaScript code loaded from a 3rd-party into your page you are giving that 3rd-party lots of potential power and you have to have a lot of trust in that 3rd-party.

  • They will get a hit for every page load and be able to see your web site traffic and see who your visitors are.
  • They could change the code at any time. If you don't trust them, they could be nefarious including hacking your site or spying on your visitors.
  • They could introduce bugs. That could open up avenues of attack for random hackers or slow your site down.
  • They could include additional 3rd party code that would give this same power to other 3rd parties.

See https://css-tricks.com/potential-dangers-of-third-party-javascript/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.