  Today, third-party JavaScript resources are indispensable part of the web
platform. More than 88% of world's top websites include at least one JavaScript
resource from a remote host. However, there is a great security risk behind
using a third-party JavaScript resource, if an attacker can infect one of these
remote JavaScript resources all websites those have included the script would
be at risk. In this paper, we present JSSignature, an entirely at the
client-side pure JavaScript framework in order to validate third-party
JavaScript resources using digital signature. Therefore, all included
JavaScript resources are checked against the integrity, authentication and
non-repudiation risks before the execution. In contrary to existing methods,
JSSignature protects web pages regardless of third-party resource infection
nature while it does not set any restrictions on trusted JavaScript providers.
This approach has an acceptable one-time performance overhead and is an easily
deployable add-in. We have validated the proposed solution by applying tests on
an implemented version\footnote{The source-code, resources and the working demo
are available at JSSignature website.
