Re: [whatwg/fetch] TypeError on Request.integrity with no-cors mode is a foot gub (#583)

It seems like the no-cors case is already protected via step 3 here:

https://w3c.github.io/webappsec-subresource-integrity/#does-response-match-metadatalist

Which does:

https://w3c.github.io/webappsec-subresource-integrity/#is-response-eligible

And if match metadatalist returns false the SRI spec suggests the integrity attribute should be ignored.



-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/583#issuecomment-324657862