Skip to content

Commit 29998b5

Browse files
authored
FF145 Relnote: Integrity-Policy and Integrity-Policy-Report-Only (mdn#41570)
* FF145 Relnote: Integrity-Policy and Integrity-Policy-Report-Only * Update files/en-us/mozilla/firefox/releases/145/index.md
1 parent 4d00799 commit 29998b5

File tree

2 files changed

+5
-19
lines changed

2 files changed

+5
-19
lines changed

files/en-us/mozilla/firefox/experimental_features/index.md

Lines changed: 0 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -741,24 +741,6 @@ Note that supported policies can be set through the [`allow`](/en-US/docs/Web/HT
741741

742742
## HTTP
743743

744-
### Integrity policy for script resources
745-
746-
The {{httpheader("Integrity-Policy")}} and {{httpheader("Integrity-Policy-Report-Only")}} HTTP headers are now supported for script resources. These allow websites to either enforce [subresource integrity guarantees](/en-US/docs/Web/Security/Subresource_Integrity) for scripts or only report violations of the policy, respectively.
747-
Note that Firefox ignores reporting endpoints, and logs violations to the developer console.
748-
When `Integrity-Policy` is used, the browser blocks the loading of scripts that either lack the [`integrity`](/en-US/docs/Web/HTML/Reference/Elements/script#integrity) attribute or have an integrity hash that doesn't match the script resource on the server.
749-
The browser will also stop requests in [`no-cors` mode](/en-US/docs/Web/API/Request/mode#no-cors) from ever being made, such as those from a {{htmlelement("script")}} element without the [`crossorigin`](/en-US/docs/Web/HTML/Reference/Attributes/crossorigin) attribute.
750-
([Firefox bug 1976656](https://bugzil.la/1976656)).
751-
752-
| Release channel | Version added | Enabled by default? |
753-
| ----------------- | ------------- | ------------------- |
754-
| Nightly | 142 | Yes |
755-
| Developer Edition | 142 | No |
756-
| Beta | 142 | No |
757-
| Release | 142 | No |
758-
759-
- `security.integrity_policy.enabled`
760-
- : Set to `true` to enable.
761-
762744
### Integrity policy for stylesheet resources
763745

764746
The {{httpheader("Integrity-Policy")}} and {{httpheader("Integrity-Policy-Report-Only")}} HTTP headers are now supported for style resources. These allow websites to either enforce [subresource integrity guarantees](/en-US/docs/Web/Security/Subresource_Integrity) for styles or only report violations of the policy, respectively.

files/en-us/mozilla/firefox/releases/145/index.md

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,11 @@ Firefox 145 is the current [Beta version of Firefox](https://www.firefox.com/en-
4444

4545
<!-- #### Removals -->
4646

47-
<!-- ### HTTP -->
47+
### HTTP
48+
49+
- The {{httpheader("Integrity-Policy")}} and {{httpheader("Integrity-Policy-Report-Only")}} HTTP headers are now supported for script resources. These allow websites to enforce [subresource integrity guarantees](/en-US/docs/Web/Security/Subresource_Integrity) for _scripts_.
50+
Note that the [`endpoints`](/en-US/docs/Web/HTTP/Reference/Headers/Integrity-Policy#endpoints) key is not yet supported (violations are logged to console).
51+
([Firefox bug 1984973](https://bugzil.la/1984973)).
4852

4953
<!-- #### Removals -->
5054

0 commit comments

Comments
 (0)