Verify that SRI is used for all elements ("require-sri") about webext-signed-pages HOT 4 OPEN

Forcing CSP is problematic because not everyone can control these headers.
Consider for example anyone hosting on github pages. They can't control the headers, but they can control the HTML and can make sure it has SRI.

from webext-signed-pages.

I think it's still a draft, but I don't know. Is require-sri even allowed in meta tags? I don't think so. I think it can only be included in HTTP headers.

Even if allowed, I don't think it should forced to be in meta, but I think having it checked / detected by the extension, so sites with insecure (no sri) inclusions would warn with a different icon or an warning message.

from webext-signed-pages.

but I think having it checked / detected by the extension

Yeah, that should definitively be done. However, if it is easier, you could also just check the CSP header. That may likely be easier (and, as such, more resistant against potential errors/bypasses). Of course, you could provide a fallback version, if CSP is not used on the site.

from webext-signed-pages.

Yeah, good point, I just say you can use CSP first, and fallback to "manual" validation that SRI is used for each element if it is not present. Such a thing may also be good for performance reasons, as users are likely better to verify require-sri than some browser add-on.

from webext-signed-pages.