Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Properly handle crossorigin resources #18

Open
kpnielsen opened this issue Jan 6, 2022 · 0 comments
Open

Properly handle crossorigin resources #18

kpnielsen opened this issue Jan 6, 2022 · 0 comments

Comments

@kpnielsen
Copy link

kpnielsen commented Jan 6, 2022

If an external resource is included in a site with crossorigin and integrity attributes, e.g. like this:

page.includeJSLibs {
	jQuery = https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js
	jQuery {
		external = 1
		integrity = sha512-894YE6QWD5I59HgZOGReFYm4dnWc1Qt5NtvYSaNcOP u1T9qYdvdihz0PPSiiqn/ /3e7Jo4EaG7TubfWGUrMQ==
		crossorigin = anonymous
	}
}

then it is pushed as Link: <https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js>; rel=preload; as="script". However, that resource is not actually preloaded, as this triggers a warning (at least in Firefox and Chrome) which reads similar to this: "A preload for 'https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js' is found, but is not used due to an integrity mismatch."

IMHO such resources should either be discarded by the extension (i.e. not pushed), or the crossorigin and integrity information should be included in the Link header: Link: <https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js>; rel=preload; as=script; crossorigin=anonymous; integrity=sha512-894YE6QWD5I59HgZOGReFYm4dnWc1Qt5NtvYSaNcOP u1T9qYdvdihz0PPSiiqn/ /3e7Jo4EaG7TubfWGUrMQ==. According to this issue that seems to be supported at least in some browsers now.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant