Skip to content

Instantly share code, notes, and snippets.

Last active June 2, 2016 20:55
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save mozfreddyb/f4b7e79ab629a3ecff663f33d9a56e82 to your computer and use it in GitHub Desktop.
Save mozfreddyb/f4b7e79ab629a3ecff663f33d9a56e82 to your computer and use it in GitHub Desktop.
New CSP directive to make Subresource Integrity mandatory (`require-sri-for`)

New CSP directive to make Subresource Integrity mandatory (require-sri-for)


GitHub is one of the first big webistes using Subresource Integrity and can thus defend against potentially bad Content Delivery Networks (CDNs). The tricky thing with SRI is that you have to include it for every HTML tag that points to a CDN if you want the security benefit. And then, of course, it happend that someone forgot to add this and people were sad. Fortunately, they brought this to the Webappsec Working Group and discussed the matter!

Omitting the details

There have been some discussions whether this should be a parameter on script-src, style-src etc. that I would like to omit for the sake of brevity. Feel free to jump into the mailing list (linked previously) if you are curious about this.

How it works

It's simple! Just add the directive into your Content Security Policy and specify if you need this for scripts, styles or both: Content-Security-Policy: require-sri-for script style


If you are running today's Firefox Nightly (June 2nd, 2016), you should not see an alert box from vising this the PHP script below:

header("Content-Security-Policy: require-sri-for script style");
<!-- This should load but cause a devtools warning because bootstrap requires jquery -->
<script src="" iintegrity="sha384-0mSbJDEHialfmuBBQP6A4Qrprq5OVfW37PRR3j5ELqxss1yVqOtnepnHVP9aJ7xS" crossorigin="anonymous"></script>

<!-- these shouldn't load and cause a CSP violation to be reported an alert popup indicates failure. -->
<script src="" integrity="foo"></script>
<script src="" integrity=""></script>
<script src=""></script>

(Sorry, no public demo URL ☹)

Calling for testers

This feature is relatively new, so we need some feedback from enthusiasts: Please see if you can find this useful in deployment (looking at you, GitHub folks) and you, security testers: Can you load scripts from other origins without integrity even though a require-sri-for policy is in place? But please see my notes on known issues below.

Feel free to look also into my patch, if you know a thing or two about C++ and Firefox. The implementation was discussed in Bugzilla bug 1265318 with the patches attached.

Known Issues

  • CSP violation reporting currently complains about the document URL that included the subresource instead of the subresource URL (bug 1277495.
  • <svg:script> is, technically speaking, not the same as HTML's <script>, so there are theoretical bypasses via SVG and other mechanisms that run scripts & styles without <link href> and <script src>. I couldn't bypass this using the obvious svg script tab, but this needs further investigation (bug 1277248).
  • Firefox doesn't manage to enforce the directive when the CSP is in a <meta> tag (bug 1277557).

Your Feedback

Please submit your feedback as bugs in Bugzilla using this link if you want someone to see it. I will not monitor IRC, Twitter or E-Mail over the next few months, as I am going to be on leave over the summer.


Thanks to Patrick Toomey from GitHub for raising the issue about SRI enforcement in the first place. Neil Matatall started bringing this into the SRI spec and Sergey Shekyan is currently continuing this. Thanks to the both of you! Thanks to Christoph Kerschbaumer for helping me work on the implementation and Jonathan Hao for doing the groundwork.

Copy link

freddyb commented Jun 2, 2016

Moved to my homepage.
Please do not comment here. I will not monitor this page for feedback.
How to submit feedback

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment