0

I have some webpages I am trying to load in my browser from file:/// and I have integrity hashes on the JS and CSS.

The JS and CSS don't load with the integrity hash present in the <link> and <script> tags but they load with it removed.

$ openssl dgst -sha384 -binary assets/css/bootstrap.min.css | openssl base64 -A
MCw98/SFnGE8fJT3GXwEOngsV7Zt27NXFoaoApmYm81iuXoPkFOJwJ8ERdknLPMO

and I have the following <script> tag:

<link rel="stylesheet" href="assets/css/bootstrap.min.css" integrity="sha384-MCw98/SFnGE8fJT3GXwEOngsV7Zt27NXFoaoApmYm81iuXoPkFOJwJ8ERdknLPMO">
nc.
  • 7,179
  • 5
  • 28
  • 38
  • Any errors on the console? – phuzi Oct 31 '18 at 11:47
  • Nope, nothing in the console. – nc. Oct 31 '18 at 12:06
  • In which browsers? You observe the same behavior in all browsers — assets don’t load, no errors in the console? – sideshowbarker Oct 31 '18 at 13:10
  • @sideshowbarker good question. I was using Chrome, and it didn't work, but in FF it loaded fine. Then I exited and restarted Chrome and started getting CORS error messages in the console, so I added a `crossorigin="anonymous"` attribute and the error went away, and I see the file getting loaded in the Network tab, but still no styles are being applied. – nc. Oct 31 '18 at 13:39
  • For Chrome you might want to disable all your extensions and try again – sideshowbarker Oct 31 '18 at 13:41

1 Answers1

0

Usually, the hash value provided for the integrity attribute is generated based on the file content. So make sure you are generating the appropriate hash from the file 'assets/css/bootstrap.min.css'. comprehensive explanation can be found from https://www.smashingmagazine.com/2019/04/understanding-subresource-integrity/

Jeelani Basha Shaik
  • 1
  • 1