Subresource Integrity: How to show only warning but not block resource?
时间:2021-09-22
本文章向大家介绍Subresource Integrity: How to show only warning but not block resource?,主要包括Subresource Integrity: How to show only warning but not block resource?使用实例、应用技巧、基本知识点总结和需要注意事项,具有一定的参考价值,需要的朋友可以参考一下。
Subresource Integrity: How to show only warning but not block resource?
Secure approach
If you need some kind of flexibility, then you should use a fallback mechanism - loading required resource from another URL. Probability that two different URL's will be hacked at the same time is a lot smaller compared to hacking just one resource. Fallback doesn't violate site security, because you must trust your known-good sources which you use in your code. If your resource is a Javascript - you can use a noncanonical-src attribute for a fallback too.
微软提供的是asp-fallback-test 最后的生成效果是
<script src="https://cdn.bootcdn.net/ajax/libs/axios/0.19.2/axios.min.js" integrity="sha384-3zW4Ss6nBzDaj/vvjP2Qwu5xaWAzOgTSccYj0DfBO/5tDzQksJa+tWrYMlYPM00u" crossorigin="anonymous"></script>
<script>(window.axios||document.write("\u003Cscript src=\u0022/lib/axios/dist/axios.min.js\u0022 integrity=\u0022sha384-3zW4Ss6nBzDaj/vvjP2Qwu5xaWAzOgTSccYj0DfBO/5tDzQksJa\u002BtWrYMlYPM00u\u0022 crossorigin=\u0022anonymous\u0022\u003E\u003C/script\u003E"));</script>
Handling load error within subresource integrity check
回答1
Take a look at this implementation of SRI-fallback:
https://github.com/cyph/sri-fallback
回答2
You can check if the loaded resource is present and load a fallback local copy:
<script src="https://code.jquery.com/jquery-1.12.0.min.js" integrity="sha256-Xxq2X+KtazgaGuA2cWR1v3jJsuMJUozyIXDB3e793L8=" crossorigin="anonymous"></script>
<script>
if (!window.jQuery) {
var script = document.createElement('script');
script.src = '/local-resources/js/jquery-1.12.0.min.js';
script.async = false;
document.head.appendChild(script);
}
</script>
原文地址:https://www.cnblogs.com/chucklu/p/15320954.html
- Silverlight学习(五)图形标绘
- radio与checkbox
- JavaScript之cookie
- Silverlight学习(四) domainservice动态多条件查询
- Android学习Tabhost、gallery、listview、imageswitcher
- ProgressBar、RatingBar和Spinner控件
- TimePicker控件、帧动画、补间动画
- Android学习之简单的数据存储
- Android学习之菜单
- Android简单登录系统
- android自定义控件
- 测试是浪费时间,我的程序肯定没问题
- Android学习自定义Dialog
- Android学习之DialogFragment
- JavaScript 教程
- JavaScript 编辑工具
- JavaScript 与HTML
- JavaScript 与Java
- JavaScript 数据结构
- JavaScript 基本数据类型
- JavaScript 特殊数据类型
- JavaScript 运算符
- JavaScript typeof 运算符
- JavaScript 表达式
- JavaScript 类型转换
- JavaScript 基本语法
- JavaScript 注释
- Javascript 基本处理流程
- Javascript 选择结构
- Javascript if 语句
- Javascript if 语句的嵌套
- Javascript switch 语句
- Javascript 循环结构
- Javascript 循环结构实例
- Javascript 跳转语句
- Javascript 控制语句总结
- Javascript 函数介绍
- Javascript 函数的定义
- Javascript 函数调用
- Javascript 几种特殊的函数
- JavaScript 内置函数简介
- Javascript eval() 函数
- Javascript isFinite() 函数
- Javascript isNaN() 函数
- parseInt() 与 parseFloat()
- escape() 与 unescape()
- Javascript 字符串介绍
- Javascript length属性
- javascript 字符串函数
- Javascript 日期对象简介
- Javascript 日期对象用途
- Date 对象属性和方法
- Javascript 数组是什么
- Javascript 创建数组
- Javascript 数组赋值与取值
- Javascript 数组属性和方法