Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Subresource Integrity in production builds #946

Closed
julien-f opened this issue Oct 23, 2016 · 9 comments
Closed

Subresource Integrity in production builds #946

julien-f opened this issue Oct 23, 2016 · 9 comments

Comments

@julien-f
Copy link

Subresource Integrity (SRI) is a security feature that enables browsers to verify that files they fetch (for example, from a CDN) are delivered without unexpected manipulation. It works by allowing you to provide a cryptographic hash that a fetched file must match.

<script
  src="https://example.com/example-framework.js"
  integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC"
  crossorigin="anonymous"
></script>

It should probably be implemented similarly to the hash generation for cache busting.

Source: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity

@julien-f julien-f changed the title Subresource Integrity in productionbuild Subresource Integrity in production builds Oct 23, 2016
@gaearon
Copy link
Contributor

gaearon commented Oct 23, 2016

Looks cool. We could do this if somebody contributes it to HtmlWebpackPlugin.

@julien-f
Copy link
Author

@gaearon
Copy link
Contributor

gaearon commented Oct 23, 2016

We'd use this if it was generated in inject: true mode.

@gaearon
Copy link
Contributor

gaearon commented Nov 20, 2016

Closing because while it sounds "nice" it doesn't seem like a must-have. If you contribute this to work with HtmlWebpackPlugin's inject mode we'd be happy to enable it.

@gaearon gaearon closed this as completed Nov 20, 2016
@XVincentX
Copy link

According to jantimon/html-webpack-plugin#491 - it's already built in.

@gaearon
Copy link
Contributor

gaearon commented Dec 6, 2016

Happy to take a PR implementing this!

@gaearon gaearon reopened this Dec 6, 2016
@XVincentX
Copy link

@gaearon Cool, it should not be that hard. Let's see if I can come up with something.

@XVincentX
Copy link

@gaearon I kicked off #1176

@gaearon
Copy link
Contributor

gaearon commented Dec 6, 2016

Fixed via #1176.

@gaearon gaearon closed this as completed Dec 6, 2016
@lock lock bot locked and limited conversation to collaborators Jan 22, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants