rhazdon / hugo-theme-hello-friend-ng

Pretty basic theme for Hugo that covers all of the essentials. All you have to do is start typing!
https://github.com/rhazdon/hugo-theme-hello-friend-ng/
Other
1.46k stars 769 forks source link

Added crossorigin="anonymous" to integrity checks in head for index.html and javascript.html #424

Closed 0phoi5 closed 1 year ago

0phoi5 commented 1 year ago

Please see https://codinginthetrenches.com/2021/06/26/cross-origin-headers-cors-aws-s3-and-aws-cloudfront/

If an Amplify/S3 AWS hosted site with https://www.site.com forwarding to https://site.com, for example, used this template, then it would break the website's CSS and JS with the browser console error "Subresource Integrity: The resource 'https://site.com/main.XYZ.css' has an integrity attribute, but the resource requires the request to be CORS enabled to check the integrity, and it is not. The resource has been blocked because the integrity cannot be enforced."

The resolution for this was to add crossorigin="anonymous" in where an 'integrity=' check is made, calling the css and js files in the head sections of the site.

I've tested this against my own AWS Amplify hosted website and it works fine now, the CSS and JS now load.