Add support for SRI

[jonathanKingston]

As a CDN provider it will soon become good practice to provide integrities.
See:
jsdelivr/jsdelivr#6029
cdnjs/cdnjs#4599

For all static assets that never change can integrities be added?

I'm here to help if anything is needed.

[jdorfman]

Hey @jonathanKingston,

I agree SRI will be a great once the W3C spec is finished. Correct me if I am wrong, but by adding it now:

• no user-agents (besides Firefox?) will recognize SRI hashes
• minor releases < 1.0.0 for npm-sri-toolbox will contain breaking changes

[ericlaw1979]

FWIW, Chrome implemented in June: https://code.google.com/p/chromium/issues/detail?id=355467

[jdorfman]

ah thank you @ericlaw1979

[jdorfman]

@jonathanKingston can you shoot me an email? jdorfman at maxcdn

Thanks!

[jdorfman]

@ericlaw1979 looks like Chromium has implemented SRI but has not hit Chrome just yet. With that aside I still want to get this underway because I believe SRI is a really important incentive initiative, especially for public CDN's.

@jonathanKingston My question is the crossorigin attribute. What does the anonymous value mean?

<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap.min.css" integrity="sha256-MfvZlkHCEqatNoGiOXveE8FIwMzZg4W85qfrfIFBfYc=" crossorigin="anonymous">

Reason I ask is with CORS, as I'm sure you know, adding * represents all origins/domains can use the resource. I hate assuming so before we continue, I want to make sure I don't advertise something that will break our users sites.

[jdorfman]

@freddyb could you help a SRI noob out? ^

[jonathanKingston]

@jdorfman sorry for the delayed response, just got home.

Anonymous means don't send credentials: https://www.npmjs.com/package/ember-cli-sri#crossorigin-attribute
So yeah CORS headers would need to be sent on the files that are referenced by bootstrap-cdn.

[jonathanKingston]

Yup Chrome Canary has an implementation in for testing purposes.

There are some caveats however they should not be important here:

• Chrome will fail open if you don't specify the crossorigin attribute on CORS requests with no CORS headers (This is to protect private resources)
• The fetch() API changes are not implemented yet

The spec changes that have been mentioned so far:

• fail closed on all CORS requests. So integrity checking won't happen unless it is specified. Which means if no CORS headers are returned then it will always fail in the network rather than being integrity checked conditionally.
• There are some upcoming wording changed to explain the rationale and other parts too.

So yeah npm-sri-toolbox shouldn't be changing in shape here any longer, however I understand your hesitation there.

[jdorfman]

@jonathanKingston that clears everything up for me. I will work with @jmervine on getting something implemented in the near future.

[jdorfman]

@jonathanKingston would it make sense to have a checkbox to toggle SRI until the spec is complete? My fear is something like this happens.

[jonathanKingston]

Before it is a 'last call' then certainly that might be a good idea. (I don't expect that time frame to be very long at all).

Long term it would be nice to not give people the choice in what they copy (educating developers that the feature exists is the core reason I am advocating it here :) ).

Please don't hesitate to pop me a mail if you have questions.

Thank you!

[jdorfman]

@jonathanKingston how about something like this:

[jonathanKingston]

👍 looks good to me

[jdorfman]

Alrighty then. @jmervine and I will start working on this...Or you can make a PR and we love you long time ;)

[jonathanKingston]

Not today certainly, however I will look into it.

The hardest part of this task looks like moving out the file list here:
https://github.com/MaxCDN/bootstrap-cdn/blob/develop/config/_config.yml

To be generated by a script when you are adding a new version.

[jonathanKingston]

Also looks like the 'hellobar' code at the bottom of the page isn't there on localhost meaning I have to manually expand the code window as the toggle isn't working.

Nearly got a PR ready.

[jmervine]

Done #564