Why does Chrome tell me that the CSP 'require-sri-for' directive is implemented behind a flag which is currently disabled?

Question

In my Content Security Policy I have included require-sri-for script. However, in the Chrome console I get a notice (not an error, just info):

The Content-Security-Policy directive 'require-sri-for' is implemented behind a flag which is currently disabled.

As far as I can interpret this, it's telling me that I am trying to require SRI for something that is disabled anyway. For example if I have: script-src 'none' then there would be no point in having require-sri-for script, as all script is disallowed anyway.

However, the notice still shows when I have script-src 'self'.

What is the proper meaning of this notice and what do I need to do to fix it?

Answer 1

Chrome tells you it knows the directive but the browser is currently configured to ignore it, no matter if it would be applied or not.

SRI (Subresource Integrity), as a W3C Recommendation, is from June 2016 but require-sri-for, the Content Security Policy directive, was introduced later in Editor's Draft in August 2016. Drafts are provided for discussion only and may change at any moment. And such experimental features are usually not enabled by default to make room for changes in the implementation, specification, or both.

Whenever Chrome spots the directive in a policy, it will first check whether experimental features are enabled, and will parse the directive and it's value if yes. If experimental features are not enabled it will log the message you're seeing:

The Content-Security-Policy directive 'require-sri-for' is implemented behind a flag which is currently disabled.

It will report the message even if scripts would be later disabled with script-src 'none', the message is logged into the console early when parsing the directive. You can see it in the source code in the CSPDirectiveList::AddDirective method.

To make the message go away you have two options:

1. Enable #enable-experimental-web-platform-features in chrome://flags/ (copy this chrome://flags/#enable-experimental-web-platform-features and paste it to your Chrome, restart the browser), and test your policy so that you're ready when require-sri-for gets shipped, however this will make the message go away just for and a very small percentage of users who enabled experimental features in their browsers

2. Remove require-sri-for from your policy, for example if you don't need it because you're using script-src 'none', and add it back later once you'd like to verify scripts

3. Wait until Chrome enables the feature for everybody, until then users will see the message in the console even if you're not verifying integrity of loaded scripts

I personally go with option 3, but I've temporarily enabled the flag to see whether the site would work once require-sri-for would ship.

Answer 2

This means that the require-sri-for feature is disabled in chrome://flags. However, I have been unable to find a relevant flag that enables this.

The Mozilla documentation states that require-sri-for has been supported in Chrome since v54, however I have tested both the latest versions of Chrome and Chromium, and this doesn't seem to be the case.

This seems to be a known bug in Chrome that currently has no fix.

Edit 2018-03-29: I have changed the accepted answer to Michal Špaček's - the mystery flag is #enable-experimental-web-platform-features.

Answer 3

When browser vendors rolls out new features, they often first hide them behind a flag. Users have to explicitly opt in to the feature to use it. This gives the vendors a small population of users to "experiment" on. In Chrome, you find the flags on the chrome://flags page.

So the message you get is telling you that this feature isn't active in Chrome unless you activate it. Taking a look at the Mozilla page for this directive, it should be on without a flag from Chrome 54 and up. Firefox still require a flag though, and IE/Edge doesn't implement it at all.

In other words, the require-sri-for CSP directive offers protection for some of your users, but not all. However, as you yourself point out, if you have script-src 'none' there is no point in requiring SRI for scripts that are forbidden anyway.