cloudflare / cloudflare/vinext

Support Subresource Integrity (SRI)

Open
#3,140 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
8.8k
Forks
406
Avg merge
2d 6h
Merged PRs (30d)
120

Description

Next.js supports Subresource Integrity (SRI) through `experimental.sri`, which generates integrity hashes for JavaScript assets at build time and adds them to the corresponding `` tags. However, Vinext currently does not appear to support SRI.

It would be useful for Vinext to support equivalent functionality, ideally through the existing Next.js-compatible configuration:

```js
export default {
experimental: {
sri: {
algorithm: 'sha384',
},
},
}
```

Contributor guide

Open the contributing guide

Research direction

Start by tracing Vinext's handling of the existing Next.js-compatible experimental configuration and the build path that emits JavaScript assets and their script tags. Confirm how the configured SHA-384 algorithm should be applied, then verify that generated tags contain matching integrity hashes.

Written by the indexing model from the issue text.

Assessment

Tech stack
nextjs, typescript, vite
Domain
build-system, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.