40

Subresource integrity is not about protecting your own code of the web application against modification. What SRI is intended to do can be seen from the description of the goals: Compromise of a third-party service should not automatically mean compromise of every site which includes its scripts. Thus, it is about protecting your use of resources ...


23

Let's say you have a site built around jQuery. You don't download jQuery and use your copy, but you use a version from a CDN, making use of the caching on client's browsers. That works because if one site uses the CDN version, it will be cached and every site that uses the same version will benefit, not having to download an identical file every time. One ...


7

The attack I think the attack they are trying to protect against is the following. Imagine santaclause.com serves an image at santaclause.com/naughty_or_nice.png to logged in users. The image is a green checkmark if the logged in user has been nice, and a red X if they have been naughty. Mallory wants to know if Alice has been nice or not. So on evil.com ...


7

Why is it limited to JS and CSS resources? But, why is it only limited to JS and CSS files? The W3C SRI specification states: The scheme specified here also applies to link and future versions of this specification are likely to expand this coverage. It also states: A future revision of this specification is likely to include integrity support for ...


5

Chrome tells you it knows the directive but the browser is currently configured to ignore it, no matter if it would be applied or not. SRI (Subresource Integrity), as a W3C Recommendation, is from June 2016 but require-sri-for, the Content Security Policy directive, was introduced later in Editor's Draft in August 2016. Drafts are provided for discussion ...


4

The HTTP Content-Security-Policy require-sri-for only aims to protect against developpers who would forget to add the integrity tag. Frederik Braun, who claims to be the author of subressource integrity wrote on his blog : GitHub is one of the first big websites using Subresource Integrity and can thus defend against potentially bad Content Delivery ...


4

What attacks are mitigated by requiring CORS for subresource integrity verification? The Same Origin Policy is the cornerstone of the client-side security model of the web through the isolation of user data. As you already know, CORS relaxes the default SOP restrictions. Without relaxing these restrictions, the origin site has no right to inspect responses, ...


3

This means that the require-sri-for feature is disabled in chrome://flags. However, I have been unable to find a relevant flag that enables this. The Mozilla documentation states that require-sri-for has been supported in Chrome since v54, however I have tested both the latest versions of Chrome and Chromium, and this doesn't seem to be the case. This ...


2

If you look at the bottom of the page you linked to where the compatibility tables are you will see that firefox has a flag which labels this functionality as "User must explicitly enable this feature." To quote: From version 49: this feature is behind the security.csp.experimentalEnabled preference (needs to be set to true). To change preferences in ...


1

When browser vendors rolls out new features, they often first hide them behind a flag. Users have to explicitly opt in to the feature to use it. This gives the vendors a small population of users to "experiment" on. In Chrome, you find the flags on the chrome://flags page. So the message you get is telling you that this feature isn't active in Chrome unless ...


Only top voted, non community-wiki answers of a minimum length are eligible