3 ms·
spec co-editor here. SRI returns false (i.e. non-matching integrity) for scripts (or stylesheets) that do not enable CORS and are not same-origin [1]. Otherwis
by bugmen0t 11y ago
spec co-editor here.
SRI returns false (i.e. non-matching integrity) for scripts (or stylesheets) that do not enable CORS and are not same-origin [1]. Otherwise, an attacker could just disable CORS to bypass SRI.
flies away
[1] https://w3c.github.io/webappsec/specs/subresourceintegrity/#does-response-match-metadatalist https://w3c.github.io/webappsec/specs/subresourceintegrity/#...