19 ms·
Subresource Integrity is better suited for that use case http://www.w3.org/TR/SRI/ http://www.w3.org/TR/SRI/
by slim 10y ago
Subresource Integrity is better suited for that use case
http://www.w3.org/TR/SRI/ http://www.w3.org/TR/SRI/
- deleted 10y ago[deleted]
- xtian 10y agoSRI is meaningless on an insecure page.
- paulddraper 10y agoBut it isn't meaningless for the assets in a secure page. Those are usually the things you want to cache anyway.
- AgentME 10y agoSubresource integrity isn't supposed to be a replacement for HTTPS. SRI is useful when you're relying on content from another domain, like loading jquery from a CDN that you're not sure is trustworthy. Just because the CDN may support HTTPS doesn't mean that you trust the CDN to give an unbackdoored version of jquery. SRI is used to require that the copy of jquery they give matches a specific hash. HTTPS can still be useful with SRI for privacy. SRI doesn't protect or verify the downloads of html pages generally.