Support subresource integrity hash
- Dominant language
- TypeScript
- Stars
- 4.4k
- Forks
- 439
- Avg merge
- 14h 32m
- Merged PRs (30d)
- 19
Description
## Describe the problem
My infosec team is requesting that we load the DocSearch JavaScript with the subresource integrity property. I noticed that the Instantsearch.js files support this, as seen in the [code snippet here](https://www.algolia.com/doc/guides/building-search-ui/installation/js/#directly-in-your-page). However the [DocSearch code snippet](https://docsearch.algolia.com/docs/DocSearch-v3#without-package-manager) does not offer the same option.
## Describe the solution
I realize that I can generate the hash myself, but that’s not a permanent solution if the source file could change without warning.
Can I use this integrity hash and expect the DocSearch JS file not to change?
```
script src="https://cdn.jsdelivr.net/npm/@docsearch/js@3" integrity="sha256-9YwDyZ6nUsvEuYEWMqPqiCUZ+3ykeo4PJ+wNy8NTIBM=%"
```
Contributor guide
Research direction
Start by comparing the DocSearch v3 installation snippet with the linked Instantsearch.js example, then inspect how the jsDelivr URL and integrity hash are presented. Done means the DocSearch loading guidance supports subresource integrity and clearly explains whether the hash remains valid when the CDN package changes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, typescript
- Domain
- documentation, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100