Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add SRI and versioning to scripts #23

Open
adriaanvanrossum opened this issue Nov 11, 2019 · 1 comment
Open

Add SRI and versioning to scripts #23

adriaanvanrossum opened this issue Nov 11, 2019 · 1 comment

Comments

@adriaanvanrossum
Copy link
Contributor

@adriaanvanrossum adriaanvanrossum commented Nov 11, 2019

This way people can embed them safely without the need to trust our servers.

Thanks to @fharper on Twitter

@adriaanvanrossum adriaanvanrossum added this to Features & bugs in Public roadmap via automation Nov 11, 2019
@adriaanvanrossum

This comment has been minimized.

Copy link
Contributor Author

@adriaanvanrossum adriaanvanrossum commented Nov 15, 2019

One thing we would love to add to this is an embedded SRI hash. Not sure it that's possible:

/*
 * SimpleAnalytics.com - Privacy friendly analytics
 * Uncompressed: github.com/simpleanalytics/scripts/blob/master/src/default.js
 * SRI hash: sha384-R4/ztc4ZlRqWjqIuvf6RX5yb/v90qNGx6fS48N0tRxiGkqveZETq72KgDVJCp2TC
 */

!function(o){if(o){var n,a,i="https://",s=i+"...",c=o.console;try{var h,u=o.navigator,l=o.location,p=o.document,d=u.userAgent,f=o.dispatchEvent,m="Not sending requests ",v=p.querySelector('script[src="https:// ...

If not possible we could also use a link that generates the SRI hash:

/*
 * SimpleAnalytics.com - Privacy friendly analytics
 * Uncompressed: github.com/simpleanalytics/scripts/blob/master/src/default.js
 * SRI hash: https://sri.simpleanalytics.com/cdn.simpleanalytics.io/hello.js
 */

!function(o){if(o){var n,a,i="https://",s=i+"...",c=o.console;try{var h,u=o.navigator,l=o.location,p=o.document,d=u.userAgent,f=o.dispatchEvent,m="Not sending requests ",v=p.querySelector('script[src="https:// ...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Public roadmap
  
Features & bugs
1 participant
You can’t perform that action at this time.