1206220 - Comments from a technical review of the Subresource Integrity page

Status: RESOLVED FIXED

(Developer Documentation Graveyard :: Security, defect)

Description

[François Marier [:francois]]

I reviewed the Subresource Integrity page (thanks for writing this so soon!):

  https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity

and here are my comments:

- Fetch() integration is not yet done in Firefox. Not sure about Chrome either.
- We should mention that the hash digest is in the Base64 format.
- <link> is only supported for stylesheets.

In addition, I have some suggestions:

- We could link to https://srihash.org, an online SRI tag generator written by me and soon to be hosted by Mozilla.
- Perhaps use sha384 instead of sha256 in the examples since that's the minimum the NSA recommends.
- Mention the support for multiple hashes in the same attribute.

We have a blog post on SRI coming up next week on Hacks.

Comment 1

[sideshowbarker [:sideshowbarker]]

Thanks for the review. I’ve now updated the page with the suggested changes

https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity

Setting needinfo=:francois to verify the changes.

Comment 2

[François Marier [:francois]]

Looking really Michael, thanks!

I made two small edits:

- improved the blurb that talks about multiple hashes
- added Fennec 43 to the compat table

The only thing I'm wondering about is how to make it clearer that <link> isn't generally supported and that it's just <link rel="stylesheet"> and <link rel="alternate">. Any ideas?

Comment 3

[François Marier [:francois]]

Attachment: fetch.html

Also, another question I have is what to do with parts that talk about Fetch integration. Neither Chrome nor Firefox implement that yet. Should we remove it from MDN until it's available in browsers?

I've attached my test page for Fetch.

Comment 4

[Jean-Yves Perrier [:teoli]]

François,

We can use the compat table at the end for both comment 2 and 3 (several lines). Not sure if it is enough: is it a temporary limitation?

For comment 3, I think a note is enough, until a browser supports it. (And if we have a bug for it, we have to be sure that we have added dev-doc-needed to it so that we don't forget to update the note and compat table when it lands.

Comment 5

[François Marier [:francois]]

(In reply to Jean-Yves Perrier [:teoli] from comment #4)
> We can use the compat table at the end for both comment 2 and 3 (several
> lines). Not sure if it is enough: is it a temporary limitation?

<link> being limited to stylesheets is not a temporary limitation, it's the only thing that's in the spec. Future versions of SRI may include support for other elements, but that's a long way off.

> For comment 3, I think a note is enough, until a browser supports it.

So you're suggesting we remove the section on Fetch from the SRI page and replace it with a note instead?

Comment 6

[Jean-Yves Perrier [:teoli]]

ni/ So I have this on my radar.

Comment 7

[François Marier [:francois]]

I think all of my comments have been addressed. Thanks!