3 ms·
> An important side note is that for Subresource Integrity to work, the CDN must support Cross-Origin Resource Sharing (CORS). If the CDN doesn't support CORS
by riquito 11y ago
> An important side note is that for Subresource Integrity to work, the CDN must support Cross-Origin Resource Sharing (CORS).
If the CDN doesn't support CORS and the browser does support subresource integrity, subresource integrity is ignored (bad, since an attacker can disable CORS before changing the js) or enforced, thus refusing to execute the js (good)?
- Alex3917 11y agoIf the CDN doesn't support CORS then presumably the user won't even get the script back, but if they do then the browser shouldn't execute it due to the lack of CORS authorization, regardless of the integrity issue.
- bugmen0t 11y agospec co-editor here. SRI returns false (i.e. non-matching integrity) for scripts (or stylesheets) that do not enable CORS and are not same-origin [1]. Otherwise, an attacker could just disable CORS to bypass SRI. flies away [1] https://w3c.github.io/webappsec/specs/subresourceintegrity/#does-response-match-metadatalist https://w3c.github.io/webappsec/specs/subresourceintegrity/#...