3 ms·
So I think there are a couple aspects to consider on this. This RFC very strongly points to hints as the purpose, but to me appears to be generically implement
by kevin_nisbet 9y ago
So I think there are a couple aspects to consider on this.
This RFC very strongly points to hints as the purpose, but to me appears to be generically implemented. So HTTP 103 can send any header, but only the final headers are authoritative. So it's really up to wherever those headers are defined to indicate what can/cannot be indicated by the headers. In other words, what a header can represent is likely a different discussion.
Subresource integrity is actually a w3c recommendation and not an IETF recommendation, so the checksum doesn't appear to be conveyed through headers. But trying to think about it logically, I don't think it's necessary to have the hashes at this stage. The web browser get's a HTTP 103, and see's the link rel and begins requesting and caching the resource. The web browser then loads the HTML, which includes the subresource integrity, that it then uses to check the result it already downloaded and cached. To validate that resource, it would need to download it anyway, the only thing HTTP 103 did was allow the the content to start downloading sooner in the process.
- Too 9y agoYou don't need to download the file to verify the contents. The purpose of having a hash in the link is to allow you to cache jQuery previously downloaded from one CDN even though the link points to another.