Conversation
**Why**: For additional protection against script manipulation, particularly in combination with CDN. See: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity changelog: Improvements, Security, Enable subresource integrity for JavaScript
| integrity: isProductionEnv, | ||
| output: 'manifest.json', | ||
| transform(manifest) { | ||
| const srcIntegrity = {}; |
There was a problem hiding this comment.
This changes the output from something like...
{
"whatever.js": {
"src": "/packs/whatever-u09n1lo.js",
"integrity": "sha256-..."
}
}...to a more consumable...
{
"integrity": {
"/packs/whatever-u09n1lo.js": "sha256-..."
}
}
mitchellhenke
left a comment
mitchellhenke
left a comment
There was a problem hiding this comment.
👏🏼 👏🏼 👏🏼 👏🏼 👏🏼 👏🏼 👏🏼
👏🏼 👏🏼 👏🏼 👏🏼 👏🏼 👏🏼 👏🏼
👏🏼 👏🏼 👏🏼 👏🏼 👏🏼 👏🏼 👏🏼
👏🏼 👏🏼 👏🏼 👏🏼 👏🏼 👏🏼 👏🏼
👏🏼 👏🏼 👏🏼 👏🏼 👏🏼 👏🏼 👏🏼
👏🏼 👏🏼 👏🏼 👏🏼 👏🏼 👏🏼 👏🏼
👏🏼 👏🏼 👏🏼 👏🏼 👏🏼 👏🏼 👏🏼
👏🏼 👏🏼 👏🏼 👏🏼 👏🏼 👏🏼 👏🏼
| javascript_include_tag( | ||
| source, | ||
| crossorigin: local_crossorigin_sources? ? true : nil, | ||
| integrity: AssetSources.get_integrity(source), |
There was a problem hiding this comment.
just to check my understanding
- we fingerprint each asset in its filename so if the content changes, we'll have new URLs
- in a 50-50 deploy state, new boxes will look for new code
- the CDN should have cached old URLs, so it will servic old code for old boxes
so this should be pretty safe in our deploy setup
There was a problem hiding this comment.
Yeah, I chatted about this a bit with @mitchellhenke and I think it should be fine. Since the manifest includes both the fingerprinted JavaScript and the corresponding integrity value for that file, it should always be consistent with itself. We're not really changing anything with regards to the availability of old assets in the CDN, so I'm assuming that would continue to work as-is. And the machines reference their own local copy of the manifest, not one in the CDN.
|
CodeClimate seems to be stuck, so I'm going to admin merge to bypass. |
3 participants
Why: For additional protection against script manipulation, particularly in combination with CDN.
See: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity
Testing Instructions:
NODE_ENV=production yarn buildrails sa. No errors in console
b. JavaScript still works