alecmuffett / eotk

Enterprise Onion Toolkit
GNU General Public License v3.0
766 stars 103 forks source link

Build kludge_disable_sri for testing #85

Closed alecmuffett closed 3 years ago

alecmuffett commented 3 years ago

Subresource integrity (SRI) is a great tool for security, however it inhibits onionification. This is a very kludgy bypass which may impact user-visible content because it does not distinguish between content and HTML/CSS, etc.

If you are going to be setting up an onion site for your content, and you use SRI, it's better to engineer content to not need rewriting if at all possible, eg: by using relative URLs; or in worst case to have a second set of content for the onion site.