[docs-infra] Enable SRI (subresource integrity)

[oliviertassinari]

Summary

There seems to be a way to do it, but it's unclear vercel/next.js#60896.

SRI should help with security. Today, we don't really have it per https://platform.securityscorecard.io/#/scorecard/mui.com/issues/OPEN

Related

• [docs-infra] Remove Google Tag Manager #829
• [docs-infra] Move to next/font #830
• [docs-infra] Use Next.js font loader material-ui#42843

Search keywords: -

[Janpot]

There seems to be a way to do it, but it's unclear

According to the docs

Limitations of SRI

• Experimental: Feature may change or be removed
• Webpack only: Not available with Turbopack
• App Router only: Not supported in Pages Router
• Build-time only: Cannot handle dynamically generated scripts

app-router only, so not viable for most of our docs.

It doesn't look like securityscorecard cares about SRI on the same domain, and I'm not so sure the Next.js experimental implementation supports third-party resources.

It looks like most of the reported issues are external fonts on the subdomains (vx.mui.com, chat.mui.com, tools-public.mui.com) the main site seems fine because of next/font. The best way to solve the issue is probably to just self-host them.

We could

• take v1.mui.com - v3.mui.com offline, they represent less than 1% of the npm downloads
• try to backport the fonts self-hosting to v4/v5/v6/v7
• next/font for chat
• continue porting tools-public to the code infra dashboard so we can discontinue it
  • [code-infra] Port KPIs from tools-public #1025
  • the new npm downloads replaces some of the pages