5 ms·

SRI alone is insufficient. Maybe a strict CSP policy that exclusively allows hash sources and forbids eval could serve as an indicator that the scripts executed

SRI alone is insufficient. Maybe a strict CSP policy that exclusively allows hash sources and forbids eval could serve as an indicator that the scripts executed on a page are immutable. Probably needs some further conditions to make it airtight.

kijin 9y ago
If you don't trust Mozilla, how do you trust them not to strip the CSP header whenever they want to serve malicious javascript?
- the8472 9y ago
  you'd still have to implement a pinning feature. the hash-only-CSP part would just be the foundation which the pin checks.