11 ms·
It might not explicitly be what SRI is meant for but it'll narrow the proxy's options to: A. Blank page B. Let the find and replace update the CSS. Generate n
by DoctorOW 4y ago
It might not explicitly be what SRI is meant for but it'll narrow the proxy's options to:
A. Blank page
B. Let the find and replace update the CSS. Generate new hashes in the HTML.
C. Find someone new to pick on.
B is time and potentially computationally expensive, so it makes C a better option.
- sublinear 4y agoA doesn't work because B doesn't prevent the attacker from regexing out the hash altogether and changing the domain name in the tags to their own.