4 ms·
If you use webpack, just drop in webpack-subresource-integrity [0] for basically "free" SRI tags on all scripts. It's not really as useful if you are serving y
by Klathmon 10y ago
If you use webpack, just drop in webpack-subresource-integrity [0] for basically "free" SRI tags on all scripts.
It's not really as useful if you are serving your static assets from the same place as the HTML (and you always use HTTPS) but if you load your js/css on another server SRI can still provide some protection.
[0] https://github.com/waysact/webpack-subresource-integrity https://github.com/waysact/webpack-subresource-integrity
- CraftThatBlock 10y agoAnd IIRC, it's built-in to creat-react-app.
- julian37 10y agoIt used to be, briefly, unfortunately it had to be removed again because create-react-app has a zero-configuration policy and SRI can break pages served without TLS unless Cache-Control: no-transform is set on the server [1]. [1] https://github.com/waysact/webpack-subresource-integrity#proxies https://github.com/waysact/webpack-subresource-integrity#pro...