Subject: FYI: signature-based SRI in W3C WebAppSec

From: Mark Nottingham <[email-masked]>
Date: Thu, 16 Nov 2017 10:29:52 +0800

Folks here might be interested in this proposal:
  https://github.com/mikewest/signature-based-sri

... which is currently being considered for adoption in W3C's WebAppSec WG. It proposes doing SubResource Integrity (i.e., an integrity check before a browser will use a JavaScript file, for example) using a signature that could be carried in a response header -- a mechanism we've discussed in the past.

See discussion:
  https://www.w3.org/mid/CAKXHy=c3nJw7vGr+6GN9P=[email-masked]

Cheers,

--
Mark Nottingham   https://www.mnot.net/