-
Notifications
You must be signed in to change notification settings - Fork 3.1k
Description
https://html.spec.whatwg.org/multipage/links.html#preload-key
includes integrity metadata, and thus <link rel="preload" integrity="..."> doesn't match with main requests without integrity attributes.
However, this is inconsistent with the preload spec:
It is important that network errors be added to the preload cache so that if a preload request results in an error, the erroneous response isn't re-requested from the network later. This also has security implications; consider the case where a developer specifies subresource integrity metadata on a preload request, but not the following resource request. If the preload request fails subresource integrity verification and is discarded, the resource request will fetch and consume a potentially-malicious response from the network without verifying its integrity [SRI].
and a @domfarolino's comment at https://bugs.chromium.org/p/chromium/issues/detail?id=981419.
Should we fix the HTML spec to match with the Preload spec, or vice versa? Which spec should be considered as the source of the truth?
cc/ @yoavweiss