1342123 - [PulseGuardian] Use Subresource Integrity (SRI) for JS loaded from a different origin

Status: RESOLVED DUPLICATE of bug 1346293

(Webtools :: Pulse, defect)

Description

[Ed Morley [:emorley]]

One of the HTTP Observatory results is:
  -5 	Subresource Integrity (SRI) not implemented, but all external scripts are loaded over https

This is presumably due to the Auth0 script loaded from:
https://cdn.auth0.com/js/lock-passwordless-2.2.3.min.js

Either SRI should be used - ie an SRI hash added to the script tag here:
https://github.com/mozilla/pulseguardian/blob/c2614f9813a6c5a5412004f89a75b9f3fcbaba51/pulseguardian/templates/base.html#L50

...or else the JS script vendored into the repo.

More info on SRI can be found here:
https://wiki.mozilla.org/Security/Guidelines/Web_Security#Subresource_Integrity
https://www.srihash.org/

Comment 1

[Mark Côté [:mcote]]

Thanks to bug 1346293 we no longer load any external scripts.