algolia / algolia/docsearch

Support subresource integrity hash

Open
#1,561 1 comment 1 reaction 0 assignees View on GitHub
Dominant language
TypeScript
Stars
4.4k
Forks
439
Avg merge
14h 32m
Merged PRs (30d)
19

Description

## Describe the problem

My infosec team is requesting that we load the DocSearch JavaScript with the subresource integrity property. I noticed that the Instantsearch.js files support this, as seen in the [code snippet here](https://www.algolia.com/doc/guides/building-search-ui/installation/js/#directly-in-your-page). However the [DocSearch code snippet](https://docsearch.algolia.com/docs/DocSearch-v3#without-package-manager) does not offer the same option.

## Describe the solution

I realize that I can generate the hash myself, but that’s not a permanent solution if the source file could change without warning.

Can I use this integrity hash and expect the DocSearch JS file not to change?

```
script src="https://cdn.jsdelivr.net/npm/@docsearch/js@3" integrity="sha256-9YwDyZ6nUsvEuYEWMqPqiCUZ+3ykeo4PJ+wNy8NTIBM=%"
```

Contributor guide

Open the contributing guide

Research direction

Start by comparing the DocSearch v3 installation snippet with the linked Instantsearch.js example, then inspect how the jsDelivr URL and integrity hash are presented. Done means the DocSearch loading guidance supports subresource integrity and clearly explains whether the hash remains valid when the CDN package changes.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, typescript
Domain
documentation, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.