search

sveltejs / sapper

The next small thing in web development, powered by Svelte
https://sapper.svelte.dev
MIT License
7k stars 434 forks source link

Subresource Integrity (SRI) #1153

Open frederikhors opened 4 years ago

frederikhors commented 4 years ago

Is your feature request related to a problem? Please describe. I think https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity is needed today.

Describe the solution you'd like Like ember already does by default (https://github.com/jonathanKingston/ember-cli-sri) it would be amazing to auto generate on build and export the correct files hash.

Describe alternatives you've considered None.

How important is this feature to you? Really important: https://cheatsheetseries.owasp.org/cheatsheets/Third_Party_Javascript_Management_Cheat_Sheet.html#subresource-integrity.

antony commented 4 years ago

@frederikhors would you mind filling in the issue template when you open an issue please - it makes it easier for us to triage / resolve issues. Thanks

frederikhors commented 4 years ago

@frederikhors would you mind filling in the issue template when you open an issue please - it makes it easier for us to triage / resolve issues. Thanks

You right. I updated the issue.

benmccann commented 4 years ago

This seems like it wouldn't be that hard to add. Pretty similar to the CSP nonce we have.

https://github.com/sveltejs/sapper/blob/7e5ffc33e5c925929c7c7791a62e752ecfc5022e/runtime/src/server/middleware/get_page_handler.ts#L332