W3C home > Mailing lists > Public > public-webappsec@w3.org > August 2015

Re: SRI fail open behaviour

From: Brad Hill <hillbrad@gmail.com>
Date: Wed, 05 Aug 2015 17:42:06 +0000
Message-ID: <CAEeYn8hWynhJxMLDkFZOfnpHiyCSmB=6QdF8wy7xrbSMsy9MCQ@mail.gmail.com>
To: Brian Smith <brian@briansmith.org>
Cc: Francois Marier <francois@mozilla.com>, "public-webappsec@w3.org" <public-webappsec@w3.org>
OK, but that doesn't mean we need a change of the behavior for handling
unknown tokens in the integrity attribute.

On Wed, Aug 5, 2015 at 10:25 AM Brian Smith <brian@briansmith.org> wrote:

> On Wed, Aug 5, 2015 at 1:19 PM, Brad Hill <hillbrad@gmail.com> wrote:
>
>> This goes back to some of the early design suggestions where we had
>> things like src="safe_url" alt-src="CDN_url" alt-src-integrity="...".  We
>> decided to cut those features for Level 1.  I'm not sure how requiring at
>> least one valid hash recognized by an SRI-aware browser helps with the case
>> where a website wants to send a different link for browsers that don't do
>> SRI at all, or which don't recognize the algorithms chosen.
>>
>
> The server would send different links based on the User-Agent or similar,
> based on its understanding of which UAs support SRI.
>
> Cheers,
> Brian
>
Received on Wednesday, 5 August 2015 17:42:44 UTC

This archive was generated by hypermail 2.3.1 : Monday, 23 October 2017 14:54:14 UTC