Browser integrity check fails for _framework/wasm/dotnet.3.2.0.js on Cloudflare with JS minification

Describe the bug

I’m hosting a Blazor WebAssembly app on Azure Static Web Apps using a custom domain subdomain. The app is proxied through Cloudflare which automatically applies minification to the JavaScript files. Cloudflare’s minified version is slightly smaller than the original dotnet.3.2.0.js file and due the contents being changed, the browser integrity check fails. This is the Chrome error: "(index):1 Failed to find a valid digest in the 'integrity' attribute for resource 'https://custom.domain.net/_framework/wasm/dotnet.3.2.0.js' with computed SHA-256 integrity '3U49m7eBt/6m4NzgFG7zc0We7jtKrywBlLXHw0r2NNk='. The resource has been blocked."

Is there a way to opt-out of the integrity checking? An attribute or meta tag we can add to the page to tell _framework/blazor.webassembly.js to generate the script-references without an integrity attribute?

I can turn off the minification for JavaScript, but it will do so for the entire site/subdomain sites I have on Cloudflare.

To Reproduce

• Host Blazor WebAssembly on any platform that would auto-optimize JavaScript files, like Cloudflare

Exceptions (if any)

"(index):1 Failed to find a valid digest in the 'integrity' attribute for resource 'https://custom.domain.net/_framework/wasm/dotnet.3.2.0.js' with computed SHA-256 integrity '3U49m7eBt/6m4NzgFG7zc0We7jtKrywBlLXHw0r2NNk='. The resource has been blocked."

Further technical details

• Include the output of dotnet --info

.NET Core SDK (reflecting any global.json):
 Version:   3.1.302
 Commit:    41faccf259

Runtime Environment:
 OS Name:     Windows
 OS Version:  10.0.18363
 OS Platform: Windows
 RID:         win10-x64
 Base Path:   C:\Program Files\dotnet\sdk\3.1.302\

Host (useful for support):
  Version: 3.1.6
  Commit:  3acd9b0cd1

.NET Core SDKs installed:
  3.1.302 [C:\Program Files\dotnet\sdk]

.NET Core runtimes installed:
  Microsoft.AspNetCore.All 2.1.13 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.1.20 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.2.7 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.App 2.1.13 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.1.20 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.2.7 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 3.1.6 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 2.1.13 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.1.20 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.2.7 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.1.6 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.WindowsDesktop.App 3.1.6 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

• Source Code: https://github.com/Swimburger/NCrontabTester

[SteveSandersonMS]

If you want to disable integrity checking, you can do so by putting <BlazorCacheBootResources>false</BlazorCacheBootResources>. As you can guess, this also disables caching of boot resources.

If you’re wondering why you can’t disable integrity checking but keep caching boot resources, it’s because it would be dangerous. If a user was to cache the wrong version of a boot resource, the app could become unusable on their browser, and there would be no way to fix it without going into the browser dev tools and manually clearing the storage for your site. We don’t want to be responsible for bricking someone’s copy of your app like that.

[SteveSandersonMS]

This is now all documented at https://docs.microsoft.com/en-us/aspnet/core/blazor/host-and-deploy/webassembly?view=aspnetcore-5.0#resolve-integrity-check-failures