search

PrivateBin / WebExtension

A proof-of-concept webextension for verifying JS integrity
BSD 2-Clause "Simplified" License
2 stars 1 forks source link

Check if Subresource Integrity supported by the browser #3

Open gjedeer opened 7 years ago

gjedeer commented 7 years ago

There doesn't seem to be an API for this, so probably a test of some kind needs to be performed.

rugk commented 7 years ago

I think in case it is not supported this add-on is useless anyway. So if it is not supported you should either display an error or - which may be for now easier to do - just only offer this add-on to supported browser version.

gjedeer commented 7 years ago

What a clusterfuck... https://stackoverflow.com/questions/19140169/how-to-detect-content-security-policy-csp

The browser version workaround is a good idea for a short term solution. There are settings like security.csp.enable in FF and, I guess, a million other things that can fail.

gjedeer commented 7 years ago

The Modernizr team failed to detect CSP https://github.com/Modernizr/Modernizr/issues/1461

rugk commented 7 years ago

Actually CSP and SRI are completely different things and you mixed them up in this issue. So either adjust the issue title or keep this issue about SRI detection.

marsjaninzmarsa commented 7 years ago

Ummm... any example browsers with support for WebExtensions and without SRI?

rugk commented 7 years ago

Hmm, good question. For SIR see here.