incubator-pagespeed-ngx icon indicating copy to clipboard operation
incubator-pagespeed-ngx copied to clipboard

Published 20 hours ago • verified publisher icon apache

Not respecting integrity attribute

Open Dreamsorcerer opened this issue 6 years ago • 0 comments
trafficstars

I have stylesheets included with an integrity attribute, such as: <link rel="stylesheet" integrity="sha256-5fdBwaEAkIK97n+WbeomkIiEcrL4lG3AcFWR7uatT98=" crossorigin="anonymous" href="https://sambull.org/wp-content/themes/penscratch/style.css" type="text/css" />

When Pagespeed optimises these stylesheets, it fails to rewrite the integrity attribute, meaning that the security check then fails and the browser doesn't load the CSS at all.

Pagespeed needs to rewrite the integrity attribute, and ideally any matching hashes in the CSP header should also be rewritten.

Dreamsorcerer avatar Jan 13 '19 14:01 Dreamsorcerer