Skip to content

Should a preload with SRI and a main request without SRI be matched? #7736

@hiroshige-g

Description

@hiroshige-g

https://html.spec.whatwg.org/multipage/links.html#preload-key
includes integrity metadata, and thus <link rel="preload" integrity="..."> doesn't match with main requests without integrity attributes.

However, this is inconsistent with the preload spec:

It is important that network errors be added to the preload cache so that if a preload request results in an error, the erroneous response isn't re-requested from the network later. This also has security implications; consider the case where a developer specifies subresource integrity metadata on a preload request, but not the following resource request. If the preload request fails subresource integrity verification and is discarded, the resource request will fetch and consume a potentially-malicious response from the network without verifying its integrity [SRI].

and a @domfarolino's comment at https://bugs.chromium.org/p/chromium/issues/detail?id=981419.

Should we fix the HTML spec to match with the Preload spec, or vice versa? Which spec should be considered as the source of the truth?

cc/ @yoavweiss

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions