I would like to externally audit what JavaScript files / libraries are being used by a website. This is part of a compliance audit to make sure nothing is being served up / used based on what we have in the documentation.

Aside from downloading the entire website is there any other way to probe for this?

  • How does downloading the website help? What if some pages require server side technology and based upon the request, it calls (renders) different scripts. What is some pages reference a scripts file but only use some of the functions within. What if some pages are built dynamically and only certain JS files are being utilised based upon some criteria (or does this matter?)? If it were me, I'd say "NO" it's up to the devs to document what libraries they call, and then for some one else to compile this list into the document, I don't see how you can succeed in the approach you describe. :( – Dave Nov 4 '14 at 8:50
  • The devs in question have not done a very good job, so I am looking for alternatives. – TheEdge Nov 4 '14 at 12:46

To determine all the possible JavaScript files a given black-box application could spit out would be analogous to the Halting problem, for which no generic algorithm can exist. You can of course get a potentially incomplete list by crawling the site.

If this is your application, and you have access to the source code, it could be deducible through code inspection.

If this is an application developed for you, by a third party, then they should tell you (if they haven't already) so that you can agree to and comply with any licence agreements for any third party code they've chosen to use (it may be included as part of their licence agreement or associated text).

  • Yeah they should tell you..... However these guys have not really followed any good development practice. I have found 4 libraries used just by manual inspection of the HTML source delivered for a single page. So I was hoping for something more systematic. – TheEdge Nov 4 '14 at 22:12
  • To play devil's advocate a bit, it shouldn't matter what they've used, as long as it works, and doesn't break any laws/licences. I'm curious to the problem you're trying to solve - are you wanting to prove their incompetence, or build requirements for someone to replace it? – Rowland Shaw Nov 5 '14 at 7:35
  • Documenting the system, making sure it will work when deployed elsewhere. Not knowing what is in there largely means it is poke it with a stick and see what breaks. And did I mention there are NO tests? :-) – TheEdge Nov 5 '14 at 9:23

Downloading the entire website would not help, since a website can (and very often), reference external files.

A simple way to see what files are downloaded is to hit F12 in Internet Explorer to open up the Developer Tools. Then go to the Network tab, refresh the page and you'll see the requests made.

enter image description here

Equivalent functions are provided in FireFox and Chrome as well.

Alternatively, you may use a tool that logs all network traffic, such as Fiddler. Wireshark is an alternative to Fiddler, but I find Fiddler much easier to use.

  • Thanks, been using Fiddler and Firebug to check stuff out. It's just manually intensive. – TheEdge Nov 4 '14 at 22:13
  • It could also miss anything that is conditionally included, if you don't exercise the condition – Rowland Shaw Nov 5 '14 at 7:32

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.