cloudflare / cloudflare/vinext
Support Subresource Integrity (SRI)
- Dominant language
- TypeScript
- Stars
- 8.8k
- Forks
- 406
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 120
Description
Next.js supports Subresource Integrity (SRI) through `experimental.sri`, which generates integrity hashes for JavaScript assets at build time and adds them to the corresponding `` tags. However, Vinext currently does not appear to support SRI.
It would be useful for Vinext to support equivalent functionality, ideally through the existing Next.js-compatible configuration:
```js
export default {
experimental: {
sri: {
algorithm: 'sha384',
},
},
}
```
Contributor guide
Research direction
Start by tracing Vinext's handling of the existing Next.js-compatible experimental configuration and the build path that emits JavaScript assets and their script tags. Confirm how the configured SHA-384 algorithm should be applied, then verify that generated tags contain matching integrity hashes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- nextjs, typescript, vite
- Domain
- build-system, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100