W3C home > Mailing lists > Public > public-webappsec@w3.org > July 2014

Re: SRI and CORS

From: Anne van Kesteren <annevk@annevk.nl>
Date: Thu, 3 Jul 2014 15:28:21 +0200
Message-ID: <CADnb78j1WHwo8ZV3O=cG3i2G=3UdFvTBPsy7BH+PrxDOp9wG7Q@mail.gmail.com>
To: Mike West <mkwst@google.com>
Cc: Adam Langley <agl@google.com>, WebAppSec WG <public-webappsec@w3.org>
Thanks AGL for killing the idea so quickly.

On Thu, Jul 3, 2014 at 3:25 PM, Mike West <mkwst@google.com> wrote:
> This is a problem with SRI generally. If you can determine that the load
> failed (and you can), then you can do this without the CORS bypass.

That does seem like a problem. Maybe SRI should not work if request's
mode is no CORS.

Received on Thursday, 3 July 2014 13:28:48 UTC

This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 18:54:39 UTC