5 ms·
Doesn't SRI require the hashes to be in the __loaded__ html? I believe parent is referring to a page which is the same, but has been compromised on the server s
by Something1234 8y ago
Doesn't SRI require the hashes to be in the __loaded__ html? I believe parent is referring to a page which is the same, but has been compromised on the server side, meaning you can't trust the html, even if the server is who it says it is.
- SahAssar 8y agoRight, but what I'm saying is that you don't need the loader. Just have a bookmarklet with html that contains script tags with SRI. The loader is just another step you need to trust.
- dividuum 8y agoThat does indeed work. Pretty neat. For anyone trying, here is basically all you need: data:text/html,<script crossorigin="anonymous" integrity="..." src="..."> In total that should be a lot smaller than the linked codegolf answer.