agreed. for simplicity, SRIv1 relied on the onerror function rather than something like csp reports. If this is useful to enough app authors, this could be considered for v2 or earlier if browser developers are so willing :)

…

On Thu, 15 Nov 2018 at 08:40, Ryan Barnett ***@***.***> wrote: If a website is using both CSP with "require-sri-for" directive and SRI and there is a hash validation error, it would be very useful to be able to levarage the CSP report-uri/report-to directive to send violation reports. Protecting end users by blocking if there are SRI errors is priority #1 <#1> however visibility into SRI failures is a close #2 <#2> for website owners to be able to identify large issues such as Magecart JS skimmer injections. Question - other browser feature such as X-XSS-Protection has been updated to piggy-back on the CSP reporting code by adding in the report option - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection#Syntax. Could SRI do similar with adding in a report flag along with the integrity and crossorigin flags? — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#20 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAIXGXQN1xX_0aAsBouSLuaatuLRnPJ0ks5uvZkVgaJpZM4G0hLl> .

Consider integrity check violation reporting #20

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions