Use asp-fallback-src

[dylanvdmerwe]

In the _Layout.cs file that is generated there is the following:

 <environment names="@EnvironmentName.Development">
        <script asp-append-version="true" src="~/js/jquery.js"></script>
        <script asp-append-version="true" src="~/js/jquery-validate.js"></script>
        <script asp-append-version="true" src="~/js/jquery-validate-unobtrusive.js"></script>
        <script asp-append-version="true" src="~/js/bootstrap.js"></script>
        <script asp-append-version="true" src="~/js/site.js"></script>
    </environment>
    <environment names="@EnvironmentName.Staging,@EnvironmentName.Production">
        @* crossorigin - Enable reporting of errors from third party scripts.
            See https://raygun.com/blog/2015/05/fixing-script-errors/
           asp-subresource-integrity-src - Ensures the CDN resource has not been tampered with.
            See http://rehansaeed.com/subresource-integrity-taghelper-using-asp-net-core *@
        <script crossorigin="anonymous"
                src="@ContentDeliveryNetwork.Google.JQueryUrl"
                asp-subresource-integrity-src="~/js/jquery.js"></script>
        <script crossorigin="anonymous"
                src="@ContentDeliveryNetwork.Microsoft.JQueryValidateUrl"
                asp-subresource-integrity-src="~/js/jquery-validate.js"></script>
        <script crossorigin="anonymous"
                src="@ContentDeliveryNetwork.Microsoft.JQueryValidateUnobtrusiveUrl"></script>
        <script crossorigin="anonymous"
                src="@ContentDeliveryNetwork.Microsoft.BootstrapUrl"
                asp-subresource-integrity-src="~/js/bootstrap.js"></script>
        @* Move site.js to a content delivery network (CDN) for better performance. *@
        <script asp-append-version="true" src="~/js/site.js"></script>
    </environment>

The asp-fallback-src and asp-fallback-test should be used as much as possible. For example if the jquery file cannot be retrieved from the CDN:

        <script crossorigin="anonymous"
                src="@ContentDeliveryNetwork.Google.JQueryUrl"
                asp-subresource-integrity-src="~/js/jquery.js"
                asp-fallback-src="~/js/jquery.js"
                asp-fallback-test="window.jQuery"
                asp-append-version="true" ></script>

See here for more information.

[dylanvdmerwe]

Note that this should replace the fallback scripts folder.

[RehanSaeed]

Inline scripts are bad for Content-Security-Policy (CSP). Which is why this logic has been moved out. There is a way to use inline scripts with CSP but this requires adding hashes to the CSP HTTP header which means that it gets very large. HTTP 1.0 does not compress headers, making this bad for performance.