Re: CSP script hashes

> I like this but I don't think it plays well with the HTML5 spec. The HTML5
> spec says that upon encountering a (non-async, non-deferred) script, the
> parser itself must block until that script executes. The reason is that the
> script can emit HTML through e.g. document.write and that emitted HTML must
> be processed immediately after the point where the executing script block
> closes. This can change the structure of the document by emitting e.g.
> unbalanced tags. So it's actually not really possible to parse beyond the
> first script block w/o executing it if we're following the HTML5 spec, as I
> understand.
>

This makes sense, thanks for clarifying. I'm on board now with the
hash-per-element approach.