Hacker News Reader

> An important side note is that for Subresource Integrity to work, the CDN must support Cross-Origin Resource Sharing (CORS).

If the CDN doesn't support CORS and the browser does support subresource integrity, subresource integrity is ignored (bad, since an attacker can disable CORS before changing the js) or enforced, thus refusing to execute the js (good)?

View on HN

spec co-editor here.

SRI returns false (i.e. non-matching integrity) for scripts (or stylesheets) that do not enable CORS and are not same-origin [1]. Otherwise, an attacker could just disable CORS to bypass SRI.

flies away

[1] https://w3c.github.io/webappsec/specs/subresourceintegrity/#...

If the CDN doesn't support CORS then presumably the user won't even get the script back, but if they do then the browser shouldn't execute it due to the lack of CORS authorization, regardless of the integrity issue.

Reply on news.ycombinator.com