Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SRI/CORS header Access-Control-Allow-Origin missing #417

Closed
ilyalyo opened this issue Apr 2, 2017 · 5 comments
Closed

SRI/CORS header Access-Control-Allow-Origin missing #417

ilyalyo opened this issue Apr 2, 2017 · 5 comments

Comments

@ilyalyo
Copy link
Contributor

ilyalyo commented Apr 2, 2017

In some cases it is imposiible to add crossorigin&integrity atribute becouse header Access-Control-Allow-Origin not provided, for example here:
https://www.statcounter.com/counter/counter.js
Should we make a request for each external link and check header?

@fulldecent

@fulldecent
Copy link
Collaborator

Sorry, I don't understand. What happens if you try to access stat counter with CORS?

@ilyalyo
Copy link
Contributor Author

ilyalyo commented Apr 3, 2017

Resource will be blocked and you will have such error:
Access to Script at 'https://www.statcounter.com/counter/counter.js' from origin 'http://127.0.0.1:4000' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://127.0.0.1:4000' is therefore not allowed access.

@fulldecent
Copy link
Collaborator

Is that behavior different than if we host the file from http://127.0.0.1:4000 and do NOT have integrity="***" crossorigin="anonymous"?

@ilyalyo
Copy link
Contributor Author

ilyalyo commented Apr 6, 2017

Yes it's different, if we have local file we doesn't check for sri/cors
We have 3 cases:

  1. Local file - doesn't need sri/cors
  2. Exteranl file with proper Access-Control-Allow-Origin header - needs sri/cors
  3. External file without proper Access-Control-Allow-Origin header - don't need sri/cors (with it it will be blocked and will not be loaded)

Now we don't check for headers, thats why we can have error in htmlproofer that sri/cors not provided for external link, but it's not possible to fix it, becouse we can not change headers in external resource.

@gjtorikian
Copy link
Owner

Uncertain if this is still an issue, original PR was closed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants