Add support for SRI

[jonathanKingston]

As a CDN provider it will soon become good practice to provide integrities.
See:
jsdelivr/jsdelivr#6029
cdnjs/cdnjs#4599

For all static assets that never change can integrities be added?

I'm here to help if anything is needed.

[scottgonzalez]

Doesn't seem like it'd be too hard to add. Are there any browsers that support SRI yet? I wouldn't want to add this until we can properly test it.

[acorncom]

Looks like it's currently in the nightlies for both Firefox and Chrome, but hasn't hit stable yet ...

[jonathanKingston]

Chrome unstable has it in.

The readme of my add-on might be useful here: https://www.npmjs.com/package/ember-cli-sri

[mozfreddyb]

Bootstrap CDN already shows integrity attributes in its HTML examples, see http://www.bootstrapcdn.com/ and click on the arrows.

Any chances you may want to show these too in your website?

cc @aulvi, whith whom I spoke before about adding Access-Control-Allow-Origin headers to code.jquery.com.

[kborchers]

Can we circle back to this now? Chrome stable now supports this and Firefox will support it in 43 (December 2015).

[jdorfman]

@kborchers @scottgonzalez getting this out would be a huge win for Web Application security. Please let me know if I can be of help in anyway.

[scottgonzalez]

Sure, you can send a PR. Everything is built in the Gruntfile. Thanks!

[jdorfman]

@scottgonzalez sweet I will see what I can do.

[scottgonzalez]

Let me know if you have any questions about how everything is built.

[jdorfman]

@scottgonzalez will do. Going to consult with @jonathanKingston regarding UX. Do you have any preferences in terms of how the code snippets (with the SRI hash) should look? Here is how we do it on BootstrapCDN:

[scottgonzalez]

I don't have any preference, but I expect this to require a major redesign.

[jdorfman]

@jmervine and I are going to come up with something simple and elegant that will work with the current design. First step will be configuring the Gruntfile.

[jmervine]

@scottgonzalez @jdorfman Generating shouldn't be an issue -- it will require a host that supports running openssl (see: bootstrap-cdn:scripts/integrity.js implementation).

@jdorfman Any direction on updating the UI would be fantastic, otherwise, I'll just drop it in there somewhere and we can discuss making it pretty as a follow up.

[jonathanKingston]

Sorry for the delay here, what https://www.jsdelivr.com/ do is quite nice and slightly less invasive explaining technology that people might not understand. Requiring developers to enable could actually entice more thought that fancy badges or lengthy explanations do.
I think easy copy facility would be worth having as the output is longer and potentially not completely visible.

The approach I have taken is adding in multiple SRI hashes into the integrity attribute which I feel somewhat explains the fail over principle of the algo used even though totally not required (However my use case installs it into the application anyway). So feel free to use one here if it simplifies the output.

I think a press release informing the user that SRI is good and that the CDN is going out of their way to protect the users of websites should reduce the number of complaints if any.

Other than that, I think keeping it simple actually works in selling this (developers mostly are inquisitive of things they have not seen before)