Elhebert / laravel-sri

Subresource Integrity hash generator for laravel
MIT License
40 stars 16 forks source link

Split the hash generation process #83

Closed Korko closed 2 years ago

Korko commented 2 years ago

Hi,

I'd like to propose a change:

I hope you'll find it interesting.

Korko

Elhebert commented 2 years ago

Thanks for the PR, but I'm going to close it.

Subresource Integrity is only useful when fetching files. It let the browser check that the files it's fetching aren't messed with. Per MDN:

Subresource Integrity (SRI) is a security feature that enables browsers to verify that files they fetch (for example, from a CDN) are delivered without unexpected manipulation. It works by allowing you to provide a cryptographic hash that a fetched file must match.

In the context of inline scripts SRI are not useful.