3 ms·
This might have been mentioned somewhere else but - will browsers remove or make an exception instead of blocking mixed-content[0] when a sub-resource integrity
by forgotpwtomain 10y ago
This might have been mentioned somewhere else but - will browsers remove or make an exception instead of blocking mixed-content[0] when a sub-resource integrity check is present? I mean there really is no reason to be paying the TLS over-head for commonly used libraries.
[0] https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_content https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_...
- Klathmon 10y agoIntegrity is only 1/3 of the major benefits of TLS. The other 2 (privacy and authentication) are very important as well and for many are the main reason TLS is wanted.
- forgotpwtomain 10y agoDo you care about privacy and authentication when downloading react.js from a CDN?
- Klathmon 10y agoYou might not, but some may. Others still may care about keeping their ISP or the public WiFi they are on from seeing they are downloading some scripts from CDNs. Things like that are great for fingerprinting (only 2 sites happen to use these 6 scripts with these specific versions, so if someone downloads those they are on one of those sites). Plus it still leaks tons of data in the headers. Request time, cache length, useragent, cookies (maybe, hopefully not), accept-* headers, if modified since leaking the last download time, and possibly a lot more.
- Narkov 10y agoWhat about confidentiality? The integrity portion of TLS may become redundant but the confidentiality portion could still be required. If you are just loading jQuery you might not care.