Subresource Integrity (SRI)

[AntonPavlenkov]

Hello,

I am facing a compliance issue, and it seems that Subresource Integrity (SRI) is required for our project. However, I'm unsure if I fully understand it or how to implement it correctly. I have searched through the documentation and on Google, but unfortunately, I couldn't find a solution to add the Subresource Integrity (SRI) attributes, such as integrity="sha384-3frxDlOvLa6GGEUwMh9AowcepHRx/rwFT9VW9yL1wv/OcerR39FEfAUHZRrqaOy2" crossorigin="anonymous" to both links and scripts.

I did attempt to use the csp option in kit.Config, but it appears to address only part of the requirement, leaving the complete SRI implementation unresolved.

Could someone please guide me on where to find the necessary information or how to correctly implement Subresource Integrity (SRI) for all relevant items? Your assistance would be greatly appreciated.

Thank you in advance!

[eltigerchino]

Hi, I don't think this is something SvelteKit supports at the moment. However, you can open an issue for it.

[AntonPavlenkov]

Thank you! I will.

[DougAnderson444]

There are plugins for vitejs, but I tried this wil sveltekit and it didn't seem to work

https://github.com/VividLemon/vite-plugin-sri/