v133 · miscellaneous

CSP hash reporting for scripts

Complex web application often need to keep tabs of the subresources that they download, for security purposes.

concepts

  1. CSP Hash Reporting

    CSP reports for inline scripts now include hash candidates. Easier to lock down inline-script CSPs incrementally.

  2. Live violation harvester

    This page runs a report-only CSP. Inject a sample inline script and watch the securitypolicyviolation event collect the hash candidate — the migration path the feature was designed to enable.

  3. Hash harvester & allowlist builder

    Paste an inline script body, get SHA-256/384/512 hash candidates, and a copy-pasteable Content-Security-Policy header line ready to drop into your migration.

  4. Report payload — before & after

    Side-by-side comparison of SecurityPolicyViolationEvent and report-to JSON before and after the Chrome 133 change — with the new scriptSample.hash field highlighted.

why it shipped

Web developers load many different script assets to their sites, and those scripts can then load other assets. Some of those assets are versioned and their content's integrity can be validated using Subresource Integrity or using Content Security Policy hashes. But other assets are dynamic, ever-green scripts that can be updated by their provider at any moment. The web platform has no means of validating the integrity of such scripts, neither in reporting nor in enforcement mode.

references