1

I use the following CSP rule:

Content-Security-Policy: require-sri-for script style

I know that if I load style and script from a CDN it will get blocked if I don't include their hash.

But if I serve my script and style from my own domain, will it remain accessible? (CORS is disabled)


I ask this because a site visitor send this to me:

2017-02-18 21:52:14.622 example.com/:1 Refused to load the stylesheet 'https://example.com/assets/css/main.css' because 'require-sri-for' directive requires integrity attribute be present for all stylesheets.
2017-02-18 21:52:14.632 example.com/:1 Refused to load the script 'https://example.com/assets/js/main.min.js' because 'require-sri-for' directive requires integrity attribute be present for all scripts.
2017-02-18 21:52:14.633 example.com/:1 Refused to load the script 'https://example.com/assets/js/katex.min.js' because 'require-sri-for' directive requires integrity attribute be present for all scripts.
2017-02-18 21:52:14.633 example.com/:1 Refused to load the script 'https://example.com/assets/js/section.min.js' because 'require-sri-for' directive requires integrity attribute be present for all scripts.
2017-02-18 21:52:14.633 example.com/:1 Refused to load the script 'https://example.com/assets/js/canvas.js' because 'require-sri-for' directive requires integrity attribute be present for all scripts.
2017-02-18 22:01:13.667 example.com/:1 Refused to load the stylesheet 'https://example.com/assets/css/main.css' because 'require-sri-for' directive requires integrity attribute be present for all stylesheets.

This doesn't sound normal and I couldn't reproduce it on any device.


Edit

I found out that it is possible to add a SRI hash to the style and script, but the question remains, is it necessary to do so?

2

require-sri-for doesn't mention anything about exceptions or exemptions for same-origin subresources so I would assume you'd need to include the hash regardless of where the resource is being loaded from.

From MDN:

The HTTP Content-Security-Policy require-sri-for directive instructs the client to require the use of Subresource Integrity for scripts or styles on the page.

And subsection 3.3.3 in the SRI specification, regarding the require-sri-for CSP directive and request verification:

3.3.3. Apply algorithm to request

This directive’s pre-request check is as follows:

Given a request (request) and a policy (policy):

  1. Let protected resource types be the result of executing §3.3.2 Parsing require-sri-for on this directive’s value.
  2. If request’s destination is a ASCII case-insensitive match for at least one token in protected resource types, and request’s integrity metadata is the empty string, return "Blocked".

Note: This logic means that request with matched destination and missing integrity metadata will be blocked even if it is not currently possible to set it’s integrity metadata. Such requests are originated by, for example, importScripts(), CSS' @import, or script/style elements without crossorigin content attribute.

  1. Return "Allowed".

Depending on your build process, it's fairly easy to generate hashes for your own content. There's a bunch of tools listed in the Mozilla Hacks article about SRI.

  • 1
    spec co-author here: There's no exception for the own origin and you will have to live without importScripts(), @import etc. - This is why it's still behind a custom pref in Firefox (and Chrome, I believe?). – freddyb Sep 24 '17 at 14:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.