2 ms·
No. Subresource Integrity Hashing allows an HTTPS site to use the trusted channel that TLS provides to verify the content of external resources it includes, eve
by azernik 12y ago
No. Subresource Integrity Hashing allows an HTTPS site to use the trusted channel that TLS provides to verify the content of external resources it includes, even if those external resources are delivered over HTTP. There still has to be an HTTPS site to provide a root of trust.
For example, example.com (delivered over HTTPS) could use jquery, and include in the page it delivers to you both the URL and a hash of the jquery scripts; you could then fetch those scripts over untrusted channels or from untrusted servers, and be sure that they are the ones that the administrators of example.com intended to reference. If example.com were not using HTTPS at all, then they could just be the resources that the Man In The Middle of your channel to example.com intended you to see.