Skip to content

Commit 0de43fc

Browse files
committed
Add SRI recommendation
1 parent 22a3c69 commit 0de43fc

File tree

1 file changed

+13
-1
lines changed

1 file changed

+13
-1
lines changed

README.md

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -309,10 +309,22 @@ Add the version of `solc` you want to use into `index.html`:
309309
<script
310310
type="text/javascript"
311311
src="https://binaries.soliditylang.org/bin/{{ SOLC VERSION }}.js"
312+
integrity="sha256-{{ BASE64-ENCODED HASH OF SOLC VERSION }}"
313+
crossorigin="anonymous"
312314
></script>
313315
```
314316

315-
(Alternatively use `https://binaries.soliditylang.org/bin/soljson-latest.js` to get the latests version.)
317+
(Alternatively, use `https://binaries.soliditylang.org/bin/soljson-latest.js` to get the latest version.)
318+
319+
It is recommended that you check the integrity of the resource being fetched before using it in your application.
320+
For that, you can use the [Subresource Integrity (SRI)](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity) feature.
321+
Adding SRI configuration to your HTML script tag ensures that the resource will only be loaded in the browser if the cryptographic hashes matches.
322+
323+
You can run the script [get-sri.sh](./get-sri.sh) informing the desired solc-js version or compute it yourself based on the base64-encoded version of the sha256 hash of the release.
324+
```
325+
./get-sri.sh 0.8.16
326+
sha256-J7KCDvk4BaZcdreUWklDJYLTBv0XoomFcJpR5kA2d8I= soljson-v0.8.16+commit.07a7930e.js
327+
```
316328

317329
This will load `solc` into the global variable `window.Module`. Then use this inside Javascript as:
318330

0 commit comments

Comments
 (0)