Re: SRI and CORS from Anne van Kesteren on 2014-07-03 (public-webappsec@w3.org from July 2014)

From: Anne van Kesteren <annevk@annevk.nl>
Date: Thu, 3 Jul 2014 15:35:47 +0200
To: Mike West <mkwst@google.com>
Cc: Adam Langley <agl@google.com>, WebAppSec WG <public-webappsec@w3.org>
Message-ID: <CADnb78j5WvZ4XVeqN5w+rJoVEaCGSbNF+gtxkOFKPgvcA0E9OQ@mail.gmail.com>

On Thu, Jul 3, 2014 at 3:31 PM, Mike West <mkwst@google.com> wrote:
> Mitigation ideas welcome:
> http://www.w3.org/TR/SRI/#cross-origin-data-leakage-1

Well, what about what I suggested? If you require mode to be CORS or
same-origin (and outlaw no CORS), you know that the contents of the
resource can be shared and as such the hash of those contents can be
shared too.

-- 
http://annevankesteren.nl/

Received on Thursday, 3 July 2014 13:36:14 UTC