New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Revive `require-sri-for`? #655

Open

yoavweiss opened this issue Sep 11, 2024 · 0 comments

Contributor

yoavweiss commented Sep 11, 2024

Related to #16

CSP used to contain a require-sri-for directive, but it was removed due to concerns around SRI not covering all script types, namely dynamic imports and workers.

As we solved dynamic imports, that may be enough to revive that proposal. The upcoming PCIv4 requirements definitely mean there's a use case for it.

We still don't have a way to apply SRI to workers, but maybe we can just not apply the policy to them?

yoavweiss mentioned this issue

Planning TPAC. #654

Closed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment