3.2.1 Agility

Multiple sets of integrity metadata may be associated with a single resource in order to provide agility in the face of future discoveries. For example, the “Hello, world.” resource described above may be described by either of the following hash expressions:

sha256-+MO/YqmqPm/BYZwlDkir51GTc9Pt9BvmLrXcRRma8u8=
sha512-rQw3wx1psxXzqB8TyM3nAQlK2RcluhsNwxmcqXE2YbgoDW735o8TPmIR4uWpoxUERddvFwjgRSGw7gNPCwuvJg==

Authors may choose to specify both, for example:

<script src="hello_world.js"
   integrity="sha256-+MO/YqmqPm/BYZwlDkir51GTc9Pt9BvmLrXcRRma8u8=
              sha512-rQw3wx1psxXzqB8TyM3nAQlK2RcluhsNwxmcqXE2YbgoDW735o8TPmIR4uWpoxUERddvFwjgRSGw7gNPCwuvJg=="
   crossorigin="anonymous"></script>

In this case, the user agent will choose the strongest hash function in the list, and use that metadata to validate the resource (as described below in the “parse metadata” and “get the strongest metadata from set” algorithms).

When a hash function is determined to be insecure, user agents MUST deprecate and eventually remove support for integrity validation using that hash function.

To allow authors to switch to stronger hash functions without being held back by older user agents, validation using unsupported hash functions acts like no integrity value was provided (see the “Does resource match metadataList” algorithm below). Authors are encouraged to use strong hash functions, and to begin migrating to stronger hash functions as they become available.

3.2.2 Priority

User agents MUST provide a mechanism of determining the relative priority of two hash functions and return the empty string if the priority is equal. That is, if a user agent implemented a function like getPrioritizedHashFunction(a, b) it would return the hash function the user agent considers the most collision-resistant. For example, getPrioritizedHashFunction('SHA-256', 'SHA-512') would return 'SHA-512' and getPrioritizedHashFunction('SHA-256', 'SHA-256') would return the empty string.

3.3.1 Apply algorithm to resource

1. Let result be the result of applying algorithm to the representation data without any content-codings applied, except when the user agent intends to consume the content with content-encodings applied. In the latter case, let result be the result of applying algorithm to the representation data.
2. Let encodedResult be result of base64-encoding result.
3. Return encodedResult.

3.3.2 Is resource eligible for integrity validation

In order to mitigate an attacker’s ability to read data cross-origin by brute-forcing values via integrity checks, resources are only eligible for such checks if they are same-origin or are the result of explicit access granted to the loading origin via CORS. [CORS]

One should note that being a privileged document (e.g. a document delivered over HTTPS) is not necessary for the use of integrity validation. Because resource integrity is only an application level security tool, and it does not change the security state of the user agent, a privileged document is unnecessary. However, if integrity is used in an unprivileged document (e.g. a document delivered over HTTP), authors should be aware that the integrity provides no security guarantees at all. For this reason, authors should only deliver integrity metadata on a potentially secure origin. See Unprivileged contexts remain unprivileged for more discussion.

Certain HTTP headers can also change the way the resource behaves in ways which integrity checking cannot account for. If the resource contains these headers, it is ineligible for integrity validation:

• Authorization or WWW-Authenticate hide resources behind a login; such non-public resources are excluded from integrity checks.
• Refresh can cause IFrame contents to transparently redirect to an unintended target, bypassing the integrity check.

The following algorithm details these restrictions:

1. Let request be the request that fetched resource.
2. If resource contains any of the following HTTP headers, return false:
   • Authorization
   • WWW-Authenticate
   • Refresh
3. If the mode of request is CORS, return true.
4. If the origin of request is resource’s origin, return true.
5. Return false.

3.3.3 Parse metadata.

This algorithm accepts a string, and returns either no metadata, or a set of valid hash expressions whose hash functions are understood by the user agent.

1. If metadata is the empty string, return no metadata.
2. Let result be the empty set.
3. For each token returned by splitting metadata on spaces:
   1. If token is not a valid metadata, skip the remaining steps, and proceed to the next token.
   2. Let algorithm be the alg component of token.
   3. If algorithm is a hash function recognized by the user agent, add token to result.
4. Return no metadata if result is empty, otherwise return result.

3.3.4 Get the strongest metadata from set.

1. Let result be the empty set and strongest be the empty string.
2. For each item in set:
   1. If result is the empty set, add item to result and set strongest to item, skip to the next item.
   2. Let currentAlgorithm be the alg component of strongest.
   3. Let newAlgorithm be the alg component of item.
   4. If the result of getPrioritizedHashFunction(currentAlgorithm, newAlgorithm) is the empty string, add item to result. If the result is newAlgorithm, set strongest to item, set result to the empty set, and add item to result.
3. Return result.

3.3.5 Does resource match metadataList?

1. If resource’s URL’s scheme is about, return true.
2. If resource is not eligible for integrity validation, return false.
3. Let parsedMetadata be the result of parsing metadataList.
4. If parsedMetadata is no metadata, return true.
5. Let metadata be the result of getting the strongest metadata from parsedMetadata.
6. For each item in metadata:
   1. Let algorithm be the alg component of metadata.
   2. Let expectedValue be the val component of metadata.
   3. Let actualValue be the result of applying algorithm to resource.
   4. If actualValue is a case-sensitive match for expectedValue, return true.
7. Return false.

This algorithm allows the user agent to accept multiple, valid strong hash functions. For example, a developer might write a script element such as:

<script src="https://foobar.com/content-changes.js"
        integrity="sha256-C6CB9UYIS9UJeqinPHWTHVqh/E1uhG5Twh+Y5qFQmYg=
                   sha256-qznLcsROx4GACP2dm0UCKCzCG+HiZ1guq6ZZDob/Tng="
        crossorigin="anonymous"></script>

which would allow the user agent to accept two different content payloads, one of which matches the first SHA256 hash value and the other matches the second SHA256 hash value.

3.7.1 HTMLLinkElement

partial interface HTMLLinkElement {
                attribute DOMString integrity;
};

3.7.2 HTMLScriptElement

partial interface HTMLScriptElement {
                attribute DOMString integrity;
};

3.9.1 The link element for stylesheets

Whenever a user agent attempts to obtain a resource pointed to by a link element that has a rel attribute with the value of stylesheet:

1. Set the integrity metadata of the request to the value of the element’s integrity attribute.

Additionally, perform the following steps before firing a load event at the element:

1. If the response’s integrity state is corrupt:
   1. Abort the load event, and treat the resource as having failed to load.
   2. Fire a simple event named error at the link element.

3.9.2 The script element

When executing step 5 of step 14 of HTML5’s “prepare a script” algorithm:

1. Set the integrity metadata of the request to the value of the element’s integrity attribute.

Insert the following steps after step 5 of step 14 of HTML5’s “prepare a script” algorithm:

6. Once the fetching algorithm has completed:
   1. If the response’s integrity state is corrupt:
      1. Fire a simple event named error at the script element, and abort these steps.