Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I thought there was a proposal in the works for adding checksums on script tags. Something like:

<script src='...' checksum='2fd4e1c67a2d28fced849ee1bb76e7391b93eb12' />

Which would allow the browser to use cached copies of files even if from different domains. Not sure where I saw that.



You are thinking of the integrity="" attribute that's part of SRI: https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

That attribute is meant to verify resource contents. The strategy of using it as a cache ID is still being discussed, but last I looked into it, there were some cache poisoning concerns.

You might find this thread useful: https://news.ycombinator.com/item?id=10311020


Great, thanks for that info!




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: