How to generate SHA for integrity html tag?

Question

I'm using this command to generate SHA hash in command line on my Mac:

openssl dgst -sha384 -binary FILENAME.js | openssl base64 -A

The result looks like this:

93Zn4wbvkSu+.......PksSwU4A+2a.....t0OOmyCompName:public

I then paste this sha with prefix in integrity html attribute: Like this:

<script type="text/javascript" integrity="sha384-93Zn4wbvkSu+.......PksSwU4A+2a.....t0OOmyCompName:public">

And Chrome gives me an error:

Error parsing 'integrity' attribute ('sha384-93Zn4wbvkSu+.......PksSwU4A+2a.....t0OOmyCompName:public'). The digest must be a valid, base64-encoded value.

I tried with myCompName:public and without. Help me please - how to correctly generate this integrity hash?

I don't use https://www.srihash.org/ because no cors enabled. Nginx serves my static files.

Yes it's documented. https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity — Nastro, Jan 06 '19 at 20:57

score 2 · Answer 1 · answered Jan 06 '19 at 21:00

2

I found an error. Do not include in your integrity token this text in the end:

myCompName:public

If you delete -A key from you command in the end it will give you the same result but without name of your local machine and :public word ending.

so the right hash will look like this:

sha384-93Zn4wbvkSu+.......PksSwU4A+2a.....t0OO

answered Jan 06 '19 at 21:00

Nastro

1,719
7
21
40

3

For completeness: `openssl dgst -sha384 -binary FILENAME.js | openssl base64` is the proper command. – Matt McCarthy Jun 05 '20 at 00:41

How to generate SHA for integrity html tag?

1 Answers1