3 ms·
I've been wanting this for a while now. The common argument against this is that this enables cache poisoning attacks where an attacker can craft malicious fil
by woadwarrior01 12y ago
I've been wanting this for a while now.
The common argument against this is that this enables cache poisoning attacks where an attacker can craft malicious files with matching hashes.
But I think the security it offers against CDNs turning rogue makes it worthwhile. Here's the draft proposal https://github.com/pwnall/script-digest https://github.com/pwnall/script-digest
- jacobgreenleaf 12y agoIf the hash was SHA-512 wouldn't that be hard?
- dsl 12y agoUgh. This proposal also suggests using "magic comments" in scripts, which needs to die. They will get stripped by things like pagespeed and various acceleration proxies, completely outside the developers control.
- voltagex_ 12y agoshouldn't it be something like <script src="blah" data-hash-sha512="...">?