5 ms·
> An important side note is that for Subresource Integrity to work, the CDN must support Cross-Origin Resource Sharing (CORS). So, an extra request per resourc
by nateabele 11y ago
> An important side note is that for Subresource Integrity to work, the CDN must support Cross-Origin Resource Sharing (CORS).
So, an extra request per resource, in other words?
- betimsl 11y agoNo, it will just compare given hash to file.
- malft 11y agoAn extra header.
- tveita 11y agoCORS doesn't require preflight requests for simple GETs and POSTs, since you can always trigger those anyway. The browser can just do the request and check the headers on the response.
- nly 11y agoWouldn't doing this on POST be dangerous? POSTs are not expected to be idempotent, so you're trusting the server to understand and check the Origin header etc.
- codedokode 11y agoYou can send POST to any server using a JS-submitted form so it doesn't introduce new attack vector.
- malft 11y agoYou get slightly more power in that you can post malformed multipart stuff.