Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

allow to add SRI to the script tag #5

Closed
Aviortheking opened this issue Feb 11, 2021 · 3 comments
Closed

allow to add SRI to the script tag #5

Aviortheking opened this issue Feb 11, 2021 · 3 comments

Comments

@Aviortheking
Copy link

Aviortheking commented Feb 11, 2021

For SRI security it would be awesome if we could add the SRI or if it would be generated
https://infosec.mozilla.org/guidelines/web_security#subresource-integrity

Current one sha-384-Wxt0f9q5Z1p6pEiVEw/jTJreeVlAcC08vg5shuvm5LccbFFLpb0aTUc6RMUSjgS7 for my custom domain (stats.dzeio.com)

@4lejandrito
Copy link
Owner

Hi @Aviortheking,

Thanks for reporting this.

I think generating it would be quite hard. It would couple this library with a specific version of the file and render it useless for users in different versions of Plausible (I'm thinking self hosted).

I think the best I can do is to allow passing the integrity attribute so that you can set your own hash.

How does that sound?

@Aviortheking
Copy link
Author

it sounds perfect !

@4lejandrito
Copy link
Owner

Fixed by 4ffec4b.

I just published 1.5.0 with support for the integrity attribute.

npm i next-plausible@1.5.0

Thanks @Aviortheking!

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants