Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support per-hash options and remove MIME type support #236

Merged
merged 7 commits into from
Apr 8, 2015
Merged

Support per-hash options and remove MIME type support #236

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
fbf2055
Added note on content negotiation.
joelweinberger Apr 2, 2015
f6e9398
Specify that the omission will have to be a type option-expression.
joelweinberger Apr 2, 2015
54e31a1
Changed integrity productions to reflect per-hash-expression options …
joelweinberger Apr 8, 2015
beec679
Got rid of MIME type references, other than note that they may be add…
joelweinberger Apr 8, 2015
7b00748
Modified metadata algorithm to generate a set of strong hashes.
joelweinberger Apr 8, 2015
1079297
MIME type fix
joelweinberger Apr 8, 2015
ba61d24
Merge remote-tracking branch 'upstream/master' into mention-content-neg
joelweinberger Apr 8, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 10 additions & 2 deletions specs/subresourceintegrity/index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,7 +147,7 @@ <h2 id="introduction">Introduction</h2>
sha256-C6CB9UYIS9UJeqinPHWTHVqh/E1uhG5Twh+Y5qFQmYg="&gt;
</code></pre>

<p class="example highlight">Scripts, of course, are not the only resource type which would benefit
<p>Scripts, of course, are not the only resource type which would benefit
from integrity validation. The scheme specified here applies to all HTML
elements which trigger fetches, as well as to fetches triggered from CSS
and JavaScript.</p>
Expand Down Expand Up @@ -260,7 +260,7 @@ <h3 id="key-concepts-and-terminology">Key Concepts and Terminology</h3>
and format of that resource. [[!MIMETYPE]]</p>

<p>The <dfn>message body</dfn> and the <dfn>transfer encoding</dfn> of a resource
are defined by <a href="http://tools.ietf.org/html/rfc7230#section-3">RFC7230, section 3</a>. [[!RFC7230]]</p>
are defined by <a href="http://tools.ietf.org/html/rfc7230#section-3">RFC7230, section 3</a>. [[!RFC7230]] </p>

<p>The <dfn>representation data</dfn> and <dfn>content encoding</dfn> of a resource
are defined by <a href="http://tools.ietf.org/html/rfc7231#section-3">RFC7231, section 3</a>. [[!RFC7231]]</p>
Expand Down Expand Up @@ -690,6 +690,14 @@ <h4 id="the-integrity-attribute">The <code>integrity</code> attribute</h4>

<p>The <code>integrity</code> IDL attribute must <a href="http://www.w3.org/TR/html5/infrastructure.html#reflect">reflect</a> the <code>integrity</code> content attribute.</p>

<div class="note">
<p>It should be noted that this syntax does not allow for <a href="https://www.igvita.com/2013/05/01/deploying-webp-via-accept-content-negotiation/">content negotiation</a> if
the developer specifies a MIME type. A change to the syntax to allow this may be
considered in a future version of the spec, but for now, if a developer wants to
use content negotiation, they will have to omit an <code>option-expression</code>.</p>

</div>

</section>
<!-- /Framework::HTML::integrity -->

Expand Down
9 changes: 9 additions & 0 deletions specs/subresourceintegrity/spec.markdown
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -571,6 +571,15 @@ value must be a valid [MIME type][].

The `integrity` IDL attribute must [reflect][] the `integrity` content attribute.

<div class="note">
It should be noted that this syntax does not allow for [content negotiation][] if
the developer specifies a MIME type. A change to the syntax to allow this may be
considered in a future version of the spec, but for now, if a developer wants to
use content negotiation, they will have to omit an `option-expression`.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would suggest being more explicit here and saying something like:

omit including a type option-expression.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.


[content negotiation]: https://www.igvita.com/2013/05/01/deploying-webp-via-accept-content-negotiation/
</div>

[reflect]: http://www.w3.org/TR/html5/infrastructure.html#reflect
</section><!-- /Framework::HTML::integrity -->

Expand Down