Introduce a hash attribute on every script tag

Issue description

The hash approach is better since it can be easily integrated into Topincs and does not require fiddling with nonces on cache hits. For this to work every script tag needs a hash and they need to be tracked so that the respective response header can be generated. Also strive to minimze the number of script tags.

Rejection comment

Seems to be more difficult and a lot of repeated and unnecessary computation. Check out where 'nonce' leads.

Reporting date

2021-08-11

Reported by

Robert Cerny

Rejection date

2021-08-11

Rejected by

Robert Cerny

Part of

Harden content security policy(Enhancement)

Related to

Introduce a nonce attribute on every script tag(Change)

Work sessions2

10294

10298

Helpful webpages

security.stackexchange.com/…hash-of-script