3 ms·
We discussed this approach -- one difficulty with it is that the website often doesn't know the hash of the resource. For example, imagine a server that takes u
by benmaurer 10y ago
We discussed this approach -- one difficulty with it is that the website often doesn't know the hash of the resource. For example, imagine a server that takes urls of the from images.fbcdn.net/abc124.jpg/200x200 and dynamically resizes the image to 200x200 px. It it is impossible to know what the hash of this resource will be without calculating it beforehand.
The subresource integrity spec supports cases where the developer is able to calculate the hash beforehand
- benjaminjackman 10y agoI hadn't considered dynamic urls as the dominant use case. But I can certainly see the importance in handling them as well. To me that feel like a function memoization problem (e.g. this example was a function of 2 parameters, height and width). For that case passing along cache-control: immutable, integrity: sha-abc123 headers in the response feels like the best current solution. Though it would be nice to somehow have the url self-descriptively assert its purity. Something to the effect of saying `I don't have the content-hash for this now but whatever i return is going to be immutable`, rather than having to muck around in the web-server protocol layer to assert that fact via cache-control: immutable. I think fundamentally the metadata on whether a particular url is immutable/pure or not, should be self evident, rather than buried in as an implementation detail in the response's http header.
- dfabulich 10y agoDid Google debate this proposal on their bug DB anywhere? Do you know how/why they settled on their chosen approach as opposed to Firefox's "immutable" CC header?