Post

Signature-based SRI is being spec'd right now: wicg.github.io/signature-ba... This will be useful for many use case and become relevant for PCIv4 compliance which requires assuring the integrity of sourced scripts (6.4.3). Please chime in and share your use cases: github.com/WICG/signatu...

Javan Rasokat

@javanrasokat.bsky.social

18 Nov 2024

Looks like PCI is a real innovation enabler. I was astound when I saw the requirements of CSP, too. Now this.

Lukas Weichselbaum

@webappsec.dev

yeah, although the risk is that there'll be funky vendor solutions until there's browser support for proper solutions (like we proxy all scripts through our service or do some funky scanning to check if any of your scripts have changed)

18/11/24, 4:52 pm0 reposts0 likes

Javan Rasokat

@javanrasokat.bsky.social

19 Nov 2024

Oh yes, I first became aware of CSP runtime monitoring through a vendor (guilty as charged).