Implementation of subresource integrity

ari / jobsworth

Project Management, Collaboration and Time Tracking.

GNU Affero General Public License v3.0

640 stars 197 forks source link

Implementation of subresource integrity #661

Closed robert-scheck closed 7 years ago

robert-scheck commented 7 years ago

Do you see chances to implement subresource integrity (https://wiki.mozilla.org/Security/Guidelines/Web_Security#Subresource_Integrity), given you are loading resources from foreign CDNs such as fonts via CSS?

ari commented 7 years ago

CORS is only useful when you want to restrict the domains which can access certain resources. Google doesn't add any such restrictions to their fonts.