2 ms·
I know this is just a game that never ends, but if they're already rewriting the HTTP requests what's stopping them from rewriting the page contents in the resp
by sublinear 4y ago
I know this is just a game that never ends, but if they're already rewriting the HTTP requests what's stopping them from rewriting the page contents in the response?
SRI is for the situation where a CDN has been poisoned, not this.
- DoctorOW 4y agoIt might not explicitly be what SRI is meant for but it'll narrow the proxy's options to: A. Blank page B. Let the find and replace update the CSS. Generate new hashes in the HTML. C. Find someone new to pick on. B is time and potentially computationally expensive, so it makes C a better option.
- sublinear 4y agoA doesn't work because B doesn't prevent the attacker from regexing out the hash altogether and changing the domain name in the tags to their own.