Subresource Integrity (SRI)
This cluster centers on discussions of Subresource Integrity (SRI), a web security feature for verifying the integrity of third-party resources like scripts from CDNs to prevent tampering or compromise. Commenters frequently cite SRI as an existing solution to the parent post's proposed idea for hashing and protecting remote assets.
Activity Over Time
Top Contributors
Keywords
Sample Comments
Not sure if this is what you're looking for, but subresource integrity perhaps?https://hacks.mozilla.org/2015/09/subresource-integrity-in-f...
Isn't this kinda solved by Subresource Integrity (SRI)?https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
Could SRI be used for this? [1][1] - https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
Subresource integrity still requires you to trust the server sending the hashes.
You can enable content security policy then hash all the javascripts and assets so only prebuilt and hashed stuff is allowed to be loaded in the web browser. There is no way to easily check that some one you trust did the hashing, but it is doable with an extension in the web browser.
Your don't need to trust the server. You can implement subresource integrity checks!
isn't this why https://developer.mozilla.org/en-US/docs/Web/Security/Subres... was invented?
As long as you use subresource integrity we have a deal! I know it's currently experimental but having native browser support is much more palatable than using JS to check the hash.
Sounds like something subresource integrity[1] could be expanded to include.[1]: https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
For content that is already public but needs to be protected from modification like images and scripts couldn't it be hashed and the hash just sent with the page your viewing. Then the browser could download extra assets from an insecure source like a proxy or cdn and know that it hasn't been modified?