Add Integrity-Policy for scripts by yoavweiss · Pull Request #133 · w3c/webappsec-subresource-integrity

yoavweiss · 2025-04-15T13:46:03Z

As discussed, this is replacing #129

It is defining two new headers: Integrity-Policy and Integrity-Policy-Report-Only that would enable developers to enforce integrity on scripts (in the immediate) and on more request destinations in the future.

`Integrity-Policy` header

Subresource-Integrity (SRI) enables developers to make sure the assets they intend to load are indeed the assets they are loading. But there's no current way for developers to be sure that all of their scripts are validated using SRI.

The Integrity-Policy header gives developers the ability to assert that every resource of a given type needs to be integrity-checked. If a resource of that type is attempted to be loaded without integrity metadata, that attempt will fail and trigger a violation report.

The Integrity-Policy header is a structured field Dictionary, where every member value is an inner list of tokens.
Possible keys are: blocked-destinations

Example usage

A developer that wants to validate that all of their script resources have integrity checks will be able to add a header similar to:

Integrity-Policy: blocked-destinations=(script), endpoints=(integrity-endpoint)

From that point, any external script that is fetched without a valid integrity attribute (that is, one that translates into non-empty integrity metadata) or with a "no-cors" request mode, will not be loaded.
It will also trigger a violation report.

The header also has a sources key. It's only possible value (as well as its default value) is "inline". It's presence would enable future-compatible additions of other integrity sources, such as headers.

Preview | Diff

yoavweiss · 2025-04-15T13:47:44Z

@mozfreddyb - this is still missing the reporting parts, but I'd appreciate your feedback on the overall direction.

mozfreddyb

Great start, thanks for kicking this off.

mozfreddyb · 2025-04-16T15:37:57Z

I have yet to look at the reporting bits, but looks good otherwise.

@annevk: Can you review the integration bits (HTML & fetch) or defer to someone who can?

yoavweiss · 2025-04-16T16:34:30Z

Points raised at WebAppSec:

We may want a future where we have different enforcement for different destinations. Maybe we can enable that through parameters? (e.g. IntegrityPolicy: destinations=(script;block image;warn))
We should report if the violation is a report-only one or an enforced one
No-cors assets should be blocked. The current algorithm doesn't cover it

yoavweiss · 2025-04-17T06:57:41Z

Another thought: An event here is redundant with a ReportingObserver. There's no reason to copy those over from CSP.

@mozfreddyb - do you agree?

mozfreddyb · 2025-04-17T08:10:34Z

Neither Firefox nor Webkit ship the Reporting API (or Reporting Observer). We should get clarity on whether there are plans to do so eventually or if this ends up being a hindrance. I'm going to ask around for Firefox.

yoavweiss · 2025-04-17T08:48:32Z

Neither Firefox nor Webkit ship the Reporting API (or Reporting Observer)

WebKit ships it (tests)

yoavweiss · 2025-04-18T03:40:48Z

Neither Firefox nor Webkit ship the Reporting API (or Reporting Observer)

WebKit ships it (tests)

Seems like it's implemented (but not shipped) in Firefox. Maybe y'all should just ship it? :)

Removed the event as it seemed spurious to what Reporting already does.

yoavweiss · 2025-04-18T03:57:40Z

We should report if the violation is a report-only one or an enforced one

No-cors assets should be blocked. The current algorithm doesn't cover it

Done

yoavweiss · 2025-04-18T04:00:06Z

We may want a future where we have different enforcement for different destinations. Maybe we can enable that through parameters? (e.g. IntegrityPolicy: destinations=(script;block image;warn))

I'm not sure what to do about this one - if that syntax works, maybe we should add a processing step such that any parameter that's not "block" would cause the value to get dropped?

Also, if we're going with this, do we need an "enforcement" key?

@camillelamy @mozfreddyb - I'd love your opinions

tomrittervg · 2025-04-18T11:54:51Z

We may want a future where we have different enforcement for different destinations. Maybe we can enable that through parameters? (e.g. IntegrityPolicy: destinations=(script;block image;warn))

I'm not sure what to do about this one - if that syntax works, maybe we should add a processing step such that any parameter that's not "block" would cause the value to get dropped?

Also, if we're going with this, do we need an "enforcement" key?

@camillelamy @mozfreddyb - I'd love your opinions

Freddy is out and I know you're trying to keep momentum; I was not at the meeting but I looking at our original notes, we did have a separate list of destinations for different enforcement levels, so I think this is still desirable.

Maybe instead of destinations and enforcement, we could have destinations-block which would be a list of destinations, and any other unrecognized key would be ignored (which I think is the behavior now?)

Then in the future we could add a destinations-warn list. Would that work?

yoavweiss · 2025-04-21T09:25:49Z

Maybe instead of destinations and enforcement, we could have destinations-block which would be a list of destinations, and any other unrecognized key would be ignored (which I think is the behavior now?)

Then in the future we could add a destinations-warn list. Would that work?

Yeah, that would work for me. (maybe calling it blocked-destinations instead..)

camillelamy · 2025-04-22T15:47:37Z

Having destinations-block and extending with other kinds of destinations if needed seems good to me.

annevk · 2025-05-14T14:53:22Z

+  1. If |headers| <a for="header list">contains</a> a <a>header</a>
+     whose <a>byte-lowercased</a> <a>header name</a>'s <a>isomorphic decode</a>
+     is "`integrity-policy`",


No. https://fetch.spec.whatwg.org/#header-list-contains already does the case-insensitive match. You just have to write it as `Integrity-Policy` (bit annoying with backslashes if you want to stay full Markdown). This will have to be redone.

Landed on "If |headers| contains ``integrity-policy``". Does that work?

annevk · 2025-05-14T14:54:14Z

+
+  A <dfn>source</dfn> is a string. The only possible value for it is "`inline`".
+
+  A <dfn>destination</dfn> is a string. The only possible value for it is "`script`".


A way to satisfy mt and I would be to define the actual type in Fetch. A middle ground might be a note. But this seems okay.

I can do that as part of the Fetch integration as a followup

Automatic update from web-platform-tests Integrity-Policy for script destinations This adds support for Integrity-Policy instead of `require-sri-for`, based on [1]. [1] w3c/webappsec-subresource-integrity#133 I2S: https://groups.google.com/a/chromium.org/g/blink-dev/c/Q304_OkDAZA/m/b3Bnyab9DgAJ Change-Id: I9599280eb94045951351368d2531d25c32c15681 Bug: 412588111 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6408111 Reviewed-by: Camille Lamy <clamy@chromium.org> Commit-Queue: Yoav Weiss (@Shopify) <yoavweiss@chromium.org> Reviewed-by: Antonio Sartori <antoniosartori@chromium.org> Reviewed-by: Adam Rice <ricea@chromium.org> Cr-Commit-Position: refs/heads/main@{#1456383} -- wpt-commits: 58c8754f2d64eda3c04c7afecca2be6799484f5b wpt-pr: 52360 Differential Revision: https://phabricator.services.mozilla.com/D249270

Automatic update from web-platform-tests Integrity-Policy for script destinations This adds support for Integrity-Policy instead of `require-sri-for`, based on [1]. [1] w3c/webappsec-subresource-integrity#133 I2S: https://groups.google.com/a/chromium.org/g/blink-dev/c/Q304_OkDAZA/m/b3Bnyab9DgAJ Change-Id: I9599280eb94045951351368d2531d25c32c15681 Bug: 412588111 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6408111 Reviewed-by: Camille Lamy <clamychromium.org> Commit-Queue: Yoav Weiss (Shopify) <yoavweisschromium.org> Reviewed-by: Antonio Sartori <antoniosartorichromium.org> Reviewed-by: Adam Rice <riceachromium.org> Cr-Commit-Position: refs/heads/main{#1456383} -- wpt-commits: 58c8754f2d64eda3c04c7afecca2be6799484f5b wpt-pr: 52360 Differential Revision: https://phabricator.services.mozilla.com/D249270 UltraBlame original commit: b2f20b0522428084cd0d1f68900d6843d2fb1b22

SHA: a7db551 Reason: push, by mozfreddyb Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

quantumpacket · 2025-06-06T23:35:29Z

Can we get an example of this new header documented in https://w3c.github.io/webappsec-subresource-integrity/#integrity-policy-section? The only example I was able to find was at the top of this PR.

See w3c/webappsec-subresource-integrity#133 for context.

yoavweiss added 3 commits April 15, 2025 14:48

Integrity Policy header

ed89288

Got a rough outline

d7ed19e

Got most of it

4284d89

yoavweiss requested a review from mozfreddyb April 15, 2025 13:46

yoavweiss mentioned this pull request Apr 15, 2025

Revive require-sri-for for scripts #129

Closed

mozfreddyb requested changes Apr 15, 2025

View reviewed changes

Comment thread index.bs Outdated

Comment thread index.bs Outdated

Comment thread index.bs Outdated

Comment thread index.bs Outdated

Comment thread index.bs Outdated

Review comments

dc51751

yoavweiss requested a review from mozfreddyb April 16, 2025 09:07

yoavweiss added 2 commits April 16, 2025 12:37

Fire an event

bea33f0

Send reports

0bf7b1e

mozfreddyb reviewed Apr 16, 2025

View reviewed changes

Comment thread index.bs Outdated

Comment thread index.bs Outdated

Comment thread index.bs

Remove event, add destination and correct algo

bea36d0

Add request mode conditions

fdd459a

yoavweiss added 2 commits April 21, 2025 11:34

Remove enforcement

baf426f

Fix up sources ref

0d5d643

jyasskin mentioned this pull request Apr 21, 2025

Integrity-Policy header for scripts w3ctag/design-reviews#1048

Closed

1 task

This was referenced Apr 23, 2025

Integrity-Policy header for scripts mozilla/standards-positions#1173

Closed

Integrity-Policy header for scripts WebKit/standards-positions#458

Closed

martinthomson reviewed May 13, 2025

View reviewed changes

Comment thread index.bs

Make destination a request destination

0c12600

yoavweiss requested a review from martinthomson May 13, 2025 07:19

yoavweiss mentioned this pull request May 13, 2025

Integrity Policy mdn/mdn#676

Closed

annevk reviewed May 14, 2025

View reviewed changes

Comment thread index.bs Outdated

Comment thread index.bs Outdated

Comment thread index.bs Outdated

Comment thread index.bs Outdated

Comment thread index.bs Outdated

Comment thread index.bs Outdated

Comment thread index.bs Outdated

Review comments

117bb35

yoavweiss requested a review from annevk May 14, 2025 13:17

annevk reviewed May 14, 2025

View reviewed changes

More fixups

5629693

yoavweiss mentioned this pull request May 15, 2025

Export named parameters for "generate and queue a report" w3c/reporting#279

Merged

Link to reporting params

6b7e05d

yoavweiss requested a review from annevk May 16, 2025 12:55

chrisn mentioned this pull request May 16, 2025

Browser API for C2PA w3c/authentic-web-workshop#20

Open

w3c deleted a comment May 19, 2025

mozfreddyb approved these changes May 20, 2025

View reviewed changes

mozfreddyb merged commit a7db551 into main May 20, 2025
2 checks passed

mozfreddyb deleted the integrity_policy branch May 20, 2025 07:27

github-actions Bot added a commit that referenced this pull request May 20, 2025

Add Integrity-Policy for scripts (#133)

681325a

SHA: a7db551 Reason: push, by mozfreddyb Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

This was referenced May 21, 2025

Move Integrity-Policy tests off of tentative web-platform-tests/wpt#52680

Merged

Integrity-Policy integration whatwg/fetch#1828

Merged

Integrity-Policy integration whatwg/html#11334

Merged

yoavweiss mentioned this pull request Jun 9, 2025

Integrity policy example #142

Merged

annevk pushed a commit to whatwg/fetch that referenced this pull request Jun 12, 2025

Integrity-Policy integration

dae533d

See w3c/webappsec-subresource-integrity#133 for context.

pmeenan pushed a commit to pmeenan/fetch that referenced this pull request Aug 25, 2025

Integrity-Policy integration

1b4fd1c

See w3c/webappsec-subresource-integrity#133 for context.


		A <dfn>source</dfn> is a string. The only possible value for it is "`inline`".

		A <dfn>destination</dfn> is a string. The only possible value for it is "`script`".

Conversation

yoavweiss commented Apr 15, 2025 • edited by pr-preview Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Integrity-Policy header

Example usage

Uh oh!

yoavweiss commented Apr 15, 2025

Uh oh!

mozfreddyb left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mozfreddyb commented Apr 16, 2025

Uh oh!

yoavweiss commented Apr 16, 2025

Uh oh!

yoavweiss commented Apr 17, 2025

Uh oh!

mozfreddyb commented Apr 17, 2025

Uh oh!

yoavweiss commented Apr 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

yoavweiss commented Apr 18, 2025

Uh oh!

yoavweiss commented Apr 18, 2025

Uh oh!

yoavweiss commented Apr 18, 2025

Uh oh!

tomrittervg commented Apr 18, 2025

Uh oh!

yoavweiss commented Apr 21, 2025

Uh oh!

camillelamy commented Apr 22, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

annevk May 14, 2025

Choose a reason for hiding this comment

Uh oh!

yoavweiss May 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

annevk May 14, 2025

Choose a reason for hiding this comment

Uh oh!

yoavweiss May 14, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

quantumpacket commented Jun 6, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

yoavweiss commented Apr 15, 2025 •

edited by pr-preview Bot

Loading

`Integrity-Policy` header

yoavweiss commented Apr 17, 2025 •

edited

Loading

yoavweiss May 14, 2025 •

edited

Loading