SRI support - Githubissues

gngrOrg / gngr

a cross-platform browser focussed on privacy.

https://gngr.info

287 stars 60 forks source link

Closed SanBlig closed 7 years ago

SanBlig commented 7 years ago

Closes #234

This provides partial support for Subresource Integrity.

The following are yet to be considered:

Cache:
- A response served through cache must undergo integrity check.
- If integrity check for a response fails, it shouldn't be added to the cache.
Check eligibility of response for integrity validation - CORS.
Check the syntax before parsing integrity tokens (probably redundant).
Support for options as part of the integrity metadata.

hrj commented 7 years ago

Excellent !

Adding to the list of things to do:

enumerate all the types of requests that can be checked for integrity. Top of my mind: requests from img and iframe elements
enumerate the protocols that can be checked for integrity. http:// and https:// would be already covered. Check data as well.

hrj commented 7 years ago

Thanks @SanBlig

I added support for options in f74e26384d04c6def2aa0739e1f3c7c75a822b8a

Other pending stuff has been copied into a new issue: https://github.com/UprootLabs/gngr/issues/237