Re: CSP script hashes

>  What about having a single inline-hash that is a digest of all allowed
>> inline content in the document, including both styles and scripts? The
>> browser would maintain a running digest as it encounters each style or
>> script tag. Once the digest matches the allowed inline-hash the browser
>> would execute the content immediately, or would report a violation upon
>> reaching the end of the document without ever matching the hash.
>>
>
> That would mean the browser cannot start executing inline scripts & styles
> until the entire HTML has been downloaded (or at the very least, the last
> inlined resource). Even for static HTMLs with multiple inlined resources,
> this can result in a significant slowdown of the page load without any
> benefit. (saving 30 bytes on the response headers doesn't seem like a
> significant benefit)
>

That's why I said the browser should execute immediately once the digest
matches the inline-hash. I believe that all uses for which inline script is
important involve script at the top of the document. Also I believe that a
browser won't start executing any script in a given tag until it reaches
the end of the tag. So even if the chunk of JS that you include at the top
of your page is very large, it won't execute any later than it normally
would.