Sub Resource Integrity

Prismic for Content Creators
1

Hi,

Our Nessus scanning is complaining about something called Sub Resource Integrity when requesting the prismic script at https://static.cdn.prismic.io/prismic.min.js

Has anyone come across this before, I'm currently wondering where to even start looking.

MDN has the following Subresource Integrity - Web security | MDN

It look like something that would need to be enabled on the Prismic end.

Any pointers much appreciated

Thanks

jason

2

You need to add an integrity attribute to the script where you import prismic.min.js.

Something like this:

<script src="https://cdn.example.com/app.js"
        integrity="sha384-+/M6kredJcxdsqkczBUjMLvqyHb1K/JThDXWsBVxMEeZHEaMKEOEct339VItX1zB"
        crossorigin="anonymous"></script>
2 Likes
3

Hi @marcellothearcane, thanks for that … We’re using Gatsby to generate a static site with content from Prismic, so I guess we should look at trying to inject the above into the Gatsby build process, or maybe use Helmet in the source to add it … you’ve given some food for thought, so thanks.

1 Like
7

This issue has been closed due to inactivity.