Comments (4)
Forcing CSP is problematic because not everyone can control these headers.
Consider for example anyone hosting on github pages. They can't control the headers, but they can control the HTML and can make sure it has SRI.
from webext-signed-pages.
I think it's still a draft, but I don't know. Is require-sri even allowed in meta tags? I don't think so. I think it can only be included in HTTP headers.
Even if allowed, I don't think it should forced to be in meta, but I think having it checked / detected by the extension, so sites with insecure (no sri) inclusions would warn with a different icon or an warning message.
from webext-signed-pages.
but I think having it checked / detected by the extension
Yeah, that should definitively be done. However, if it is easier, you could also just check the CSP header. That may likely be easier (and, as such, more resistant against potential errors/bypasses). Of course, you could provide a fallback version, if CSP is not used on the site.
from webext-signed-pages.
Yeah, good point, I just say you can use CSP first, and fallback to "manual" validation that SRI is used for each element if it is not present. Such a thing may also be good for performance reasons, as users are likely better to verify require-sri
than some browser add-on.
from webext-signed-pages.
Related Issues (20)
- (Optionally) use toolbar icon instead of address bar icon in Firefox HOT 4
- Always reports "No signature expected" HOT 8
- Show popup on bad/missing signature HOT 2
- Add release support/downgrade protection HOT 5
- Add support for Minimizer Version HOT 9
- Change canonisation method from minimsation to something less intrusive HOT 5
- Breaks downloads HOT 15
- Chrome store extension doesn't think client.etesync.com is good. HOT 9
- Thoughts on "HTML Signing Profile"? HOT 2
- Support for DNS TXT record with master signing key for domain HOT 3
- Switch to minisign signatures?
- Code Verify browser extension + manifest HOT 1
- Support SSH signing HOT 1
- Disable JS for pages with a bad/missing signature HOT 3
- Extension no longer works in Firefox 118
- -- is not allowed in HTML comments HOT 7
- Verify JavaScript only HOT 6
- Sign git commits & releases HOT 10
- Bubled PGP keys: How to prevent forgery? How do you verify PRs? HOT 4
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from webext-signed-pages.