News for hackers. Stuff that matters.

A comment on Do not let your CDN betray you: Use Subresource Integrity.

Re:Do not let your CDN betray you: Use Subresource Integrity by nateabele on Thursday October 01, 2015 @09:41AM (#10311007)
> An important side note is that for Subresource Integrity to work, the CDN must support Cross-Origin Resource Sharing (CORS).

So, an extra request per resource, in other words?

[ Parent | on HN ]
Re:Do not let your CDN betray you: Use Subresource Integrity by tveita on Thursday October 01, 2015 @11:29AM (#10311806)
CORS doesn't require preflight requests for simple GETs and POSTs, since you can always trigger those anyway. The browser can just do the request and check the headers on the response.
[ Parent | on HN ]
Re:Do not let your CDN betray you: Use Subresource Integrity by nly on Thursday October 01, 2015 @03:18PM (#10313888)
Wouldn't doing this on POST be dangerous? POSTs are not expected to be idempotent, so you're trusting the server to understand and check the Origin header etc.
[ Parent | on HN ]
Re:Do not let your CDN betray you: Use Subresource Integrity by codedokode on Thursday October 01, 2015 @04:01PM (#10314221)
You can send POST to any server using a JS-submitted form so it doesn't introduce new attack vector.
[ Parent | on HN ]
Re:Do not let your CDN betray you: Use Subresource Integrity by malft on Sunday October 04, 2015 @10:17AM (#10327557)
You get slightly more power in that you can post malformed multipart stuff.
[ Parent | on HN ]
Re:Do not let your CDN betray you: Use Subresource Integrity by betimsl on Thursday October 01, 2015 @09:50AM (#10311060)
No, it will just compare given hash to file.
[ Parent | on HN ]
Re:Do not let your CDN betray you: Use Subresource Integrity by malft on Thursday October 01, 2015 @09:57AM (#10311126)
An extra header.
[ Parent | on HN ]