Why does Firefox tell me

Content Security Policy: Couldn’t process unknown directive ‘require-sri-for’

when Mozilla's documentation says they've implemented it?

The meta tag Firefox is complaining about:

<meta http-equiv="Content-Security-Policy" content="require-sri-for script;"/>

If you look at the bottom of the page you linked to where the compatibility tables are you will see that firefox has a flag which labels this functionality as "User must explicitly enable this feature." To quote:

From version 49: this feature is behind the security.csp.experimentalEnabled preference (needs to be set to true). To change preferences in Firefox, visit about:config.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.