Open for signatureElectronice-7723 · Parliament 45

Limit non-essential web scripts

Sign on the House of Commons website

Petitioners ask the House to review cyber risks of client-side web scripts used by federally regulated financial institutions, create binding rules favouring secure HTML5/browser-native alternatives, and require a 'script‑minimal by default' policy for digital banking.

Why we would sign this petition

  • Reduces the attack surface of banking websites by removing or limiting client-side scripts that can enable data exfiltration, session hijacking, or supply‑chain compromise.
  • Promotes use of standards-based HTML5 and browser-native features, which can simplify implementations and lower script-related vulnerabilities.
  • A binding 'script-minimal by default' rule would create a consistent security baseline across federally regulated financial institutions.

Why we wouldn’t sign this petition

  • Some features and user experiences rely on client-side scripts and reimplementing them in HTML5 may reduce functionality or require unacceptable changes.
  • Developing and enforcing binding regulations and migrating legacy systems could be costly, time-consuming and technically complex for institutions.
  • A strict, across-the-board 'script-minimal' mandate might block legitimate third-party services or require many exceptions, risking operational disruption.

The summary and both sets of reasons are AI-generated from the petition and given equal weight. Claims are the petitioners’ own; consult the official record for the full text.

Official petition

Petition to the House of Commons in Parliament assembled Canadians increasingly depend on online banking websites and applications to manage essential financial affairs; Many banking websites rely extensively on client-side web scripts, including third-party scripts, to deliver features that could alternatively be implemented using modern, standards-based HTML5 and browser-native capabilities; Web scripts increase the attack surface of banking platforms and are a recognized vector for data exfiltration, supply-chain compromise, session hijacking, and unauthorized manipulation of web content; HTML5 and related web standards provide native, script-minimal alternatives for many common functions, reducing complexity and exposure to script-based vulnerabilities; and The protection of Canadians’ financial and personal information is a matter of national economic security and public trust. We, the undersigned, citizens and residents of Canada, call upon the House of Commons in Parliament assembled to: 1. Review the cybersecurity risks associated with the use of client-side web scripts on websites and applications operated by federally regulated financial institutions; 1. Review the cybersecurity risks associated with the use of client-side web scripts on websites and applications operated by federally regulated financial institutions; 2. Develop legislation, regulations, or binding standards that prioritize the elimination or strict limitation of non- essential web scripts in favour of secure, standards-based HTML5 and browser-native technologies; and 3. Require federally regulated financial institutions to adopt a “script-minimal by default” approach to digital banking to reduce systemic cyber risk and better protect Canadians.

Government response

No government response is available yet.