Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Provide optional SRI hash when displaying embed code

See original GitHub issue

Some operators might prefer to embed the Offen script with an integrity attribute to prevent eventual MITM scenarios.

The embed code box in the Auditorium could provide a toggle for displaying the snippet with such an SRI value added. The default behavior should still be using no hash (as this is easier to upgrade).

Issue Analytics

State:
Created 3 years ago
Comments:22 (22 by maintainers)

Top GitHub Comments

1reaction

m90commented, Jul 24, 2022

Unfortunately I forgot about one thing when I wrote my last comment: if you compute the hash off of a version that you fetch at runtime, the very calculation is vulnerable to MITM attacks, which is what the SRI hash is even supposed to prevent. I.e. if someone compromises the script.js asset somehow without you noticing, you will happily add the integrity value of the compromised asset. I’m sorry I didn’t catch this earlier and I hope you didn’t invest too much time in it yet.

Moving on, I can see two other ways to implement this:

Compute hash at build time

The build for auditorium assets could pull in the previously built script assets (plural as there are multiple locales available) and compute their hashes. These values are then injected into the build as environment variables and the code could just read them from process.env.SCRIPT_INTEGRITY_HASH or similar.

This is probably the “safest” way to do it.

Compute hash on the server

Alternatively, the hash could be computed by the Go application at runtime. This value is then injected into the rendered HTML template for the Auditorium which can then read the hash from a global variable or similar.

Do you think that makes sense? Let me know if I should clarify anything or if you think that I’m missing something.

0reactions

raLaaaacommented, Jul 28, 2022

Hey, thank you for your feedback @hendr-ik . I think I like your suggestion more than my current implementation because it is a little bit more straight forward and more clear.

I’ll still post it here as basis for discussion: