Why is it limited to JS and CSS resources?
But, why is it only limited to JS and CSS files?
The W3C SRI specification states:
The scheme specified here also applies to link and future versions of this specification are likely to expand this coverage.
It also states:
A future revision of this specification is likely to include integrity support for all possible subresources, i.e., a, audio, embed, iframe, img, link, object, script, source, track, and video elements.
It seems that this is just the first version of the specification. The github repository also includes a milestone referencing issues the second version of the specification will address. For example, there is a github issue regarding adding the ability to add the integrity for downloads.
I tried to pin a LESS (CSS variant) file, of which the integrity tag was ignored by Firefox and Chrome.
It seems that they follow the specification to the letter. The first version is about adding the integrity for the
script HTML elements, but not for every attribute. The specification only mentions handling the
integrity attribute for the
link element when
Whenever a user agent attempts to obtain a resource pointed to by a link element that has a rel attribute with the keyword of stylesheet
By looking at the Less website, we see that they rely on
link but with
rel="stylesheet/less", thus not part of the specification.
Maybe you could file an issue on their github repository for the second version?
Why is it limited to external resources?
why not add it on all browser included files (even self-hosted)?
By looking at the specification it does not seem it was part of their threat model. Here is their first goal:
Compromise of a third-party service should not automatically mean compromise of every site which includes its scripts.