3 ms·
Well, they can change it if it and the resource are not served over HTTPS by changing both the hash and the response for the resource. This doesn't add much un
by richbradshaw 12y ago
Well, they can change it if it and the resource are not served over HTTPS by changing both the hash and the response for the resource.
This doesn't add much unless at least the parent page is using HTTPS, else the hash can simply be stripped anyway. If browsers had an HSTS type precache list for sites that must use hashes, if they aren't using HTTPS then the resource and the hash can be changed.