Skip to content

Compare the strongest integrity metadata when reusing a preload #13044

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
annevk wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Compare the strongest integrity metadata when reusing a preload #13044

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b0c2fe6
Ignore order when comparing preload integrity metadata
annevk Oct 7, 2026
639df9a
fixup! Ignore order when comparing preload integrity metadata
annevk Oct 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 15 additions & 14 deletions source
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2361,8 +2361,9 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
<dfn data-x="set create" data-x-href="https://infra.spec.whatwg.org/#set-create">create</dfn>,
<dfn data-x="set difference" data-x-href="https://infra.spec.whatwg.org/#set-difference">difference</dfn>,
<dfn data-x="set intersection" data-x-href="https://infra.spec.whatwg.org/#set-intersection">intersection</dfn>,
<dfn data-x="set subset" data-x-href="https://infra.spec.whatwg.org/#set-subset">subset</dfn> and
<dfn data-x="set union" data-x-href="https://infra.spec.whatwg.org/#set-union">union</dfn></li>
<dfn data-x="set subset" data-x-href="https://infra.spec.whatwg.org/#set-subset">subset</dfn>,
<dfn data-x="set union" data-x-href="https://infra.spec.whatwg.org/#set-union">union</dfn>, and
<dfn data-x="set unordered equal" data-x-href="https://infra.spec.whatwg.org/#set-unordered-equal">unordered equal</dfn></li>
<li>The <dfn data-x-href="https://infra.spec.whatwg.org/#struct">struct</dfn> specification type and the associated definition for
<dfn data-x="struct item" data-x-href="https://infra.spec.whatwg.org/#struct-item">item</dfn></li>
<li>The <dfn data-x-href="https://infra.spec.whatwg.org/#byte-sequence">byte sequence</dfn> data structure</li>
Expand Down Expand Up @@ -29513,31 +29514,31 @@ document.body.appendChild(wbr);</code></pre>
<li><p>Let <var>entry</var> be <var>preloads</var>[<var>key</var>].</p></li>

<li><p>Let <var>consumerIntegrityMetadata</var> be the result of
<span data-x="parse integrity metadata">parsing</span> <var>integrityMetadata</var>.</p></li>
<span data-x="get the strongest metadata from set">getting the strongest metadata</span> from the
result of <span data-x="parse integrity metadata">parsing</span>
<var>integrityMetadata</var>.</p></li>

<li><p>Let <var>preloadIntegrityMetadata</var> be the result of
<span data-x="parse integrity metadata">parsing</span> <var>entry</var>'s
<span data-x="get the strongest metadata from set">getting the strongest metadata</span> from the
result of <span data-x="parse integrity metadata">parsing</span> <var>entry</var>'s
<span data-x="preload integrity metadata">integrity metadata</span>.</p></li>

<li>
<p>If none of the following conditions apply:</p>

<ul>
<li><p><var>consumerIntegrityMetadata</var> is <code data-x="">no metadata</code>;</p></li>

<li>
<p><var>consumerIntegrityMetadata</var> is equal to <var>preloadIntegrityMetadata</var>;
or</p>
<li><p><var>consumerIntegrityMetadata</var> <span data-x="list is empty">is empty</span>;
or</p></li>

<p class="XXX">This comparison would ignore unknown integrity options. See <a
href="https://github.com/w3c/webappsec-subresource-integrity/issues/116">issue #116.</a></p>
</li>
<li><p><var>consumerIntegrityMetadata</var> is
<span data-x="set unordered equal">unordered equal</span> to
<var>preloadIntegrityMetadata</var>,</p></li>
</ul>

<p>then return false.</p>

<p class="note">A mismatch in integrity metadata between the preload and the consumer, even if
both match the data, would lead to an additional fetch from the network.</p>
<p class="note">A mismatch in the strongest integrity metadata between the preload and the
consumer, even if both match the data, would lead to an additional fetch from the network.</p>

<p class="note">It is important that <span data-x="network error">network errors</span> are
added to the preload cache so that if a preload request results in an error, the erroneous
Expand Down
Loading