demo · v135

Sign a script. Verify in the browser.

Chrome 135 ships signature-based Subresource Integrity. The demo generates an Ed25519 keypair, signs a script blob, builds the <script integrity="ed25519-…"> markup, then runs WebCrypto verification — flipping a byte to show the failure path.

Ed25519 in WebCrypto: ?

1. signature (base64)

—

2. generated tag

—

3. verification result

—

see also

`; await verify(bodyBytes); } async function verify(bytes) { if (!kp) return; const ok = await crypto.subtle.verify(signParams(), kp.publicKey, sig, bytes); const r = document.getElementById("result"); r.textContent = ok ? "OK — browser would execute the script" : "FAIL — browser would block"; r.classList.toggle("ok", ok); r.classList.toggle("bad", !ok); } document.getElementById("gen").addEventListener("click", gen); document.getElementById("tamper").addEventListener("click", async () => { if (!bodyBytes) return; const t = new Uint8Array(bodyBytes); t[0] ^= 0x01; await verify(t); });