Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for Subresource Integrity #176

Open
tmaier opened this issue Jan 13, 2022 · 7 comments
Open

Add support for Subresource Integrity #176

tmaier opened this issue Jan 13, 2022 · 7 comments
Labels
enhancement New feature or request planned: 4.0 To be released in 4.0

Comments

@tmaier
Copy link

tmaier commented Jan 13, 2022

Is your feature request related to a problem? Please describe.

Similar to rails/webpacker#323

Sprockets supported subresource integrity out of the box. It would be nice if

vite_javascript_tag 'application', integrity: true

worked the same.

Describe the solution you'd like
Calculate the hash for each file and add it to the relevant tags

Describe alternatives you've considered
None.

Additional context

@ElMassimo

This comment has been minimized.

@ElMassimo ElMassimo added the enhancement New feature or request label Jan 13, 2022
@ElMassimo ElMassimo changed the title Subresource Integrity Add support for Subresource Integrity Jan 15, 2022
@ElMassimo
Copy link
Owner

@tmaier Given that this requires changes to public APIs in ViteRuby::Manifest, it will need to wait for the next major release.

Experimental support is available in the next branch, you can try it now by explicitly adding 4.0.0.alpha1 to your Gemfile:

gem 'vite_rails', '~> 4.0.0.alpha1'

You must also add vite-plugin-manifest-sri to your package.json and configure it in vite.config.ts:

import { defineConfig } from 'vite'
import RubyPlugin from 'vite-plugin-ruby'
import ManifestSRI from 'vite-plugin-manifest-sri'

export default defineConfig({
  plugins: [
    RubyPlugin(),
    ManifestSRI(),
  ],
})

@ElMassimo ElMassimo added the planned: 4.0 To be released in 4.0 label Jan 18, 2022
@vladimirtemnikov
Copy link
Contributor

@ElMassimo is this feature still not ready to release? Could be really helpful for security reasons.

@ElMassimo
Copy link
Owner

ElMassimo commented Aug 3, 2023

The implementation in 4.0.0.alpha1 lives in the next branch, and is "ready".

Given that this requires changes to public APIs in ViteRuby::Manifest, it will need to wait for the next major release.

This hasn't been a highly requested feature. I'm waiting for either breaking changes in Vite or something else that justifies releasing a new major.

@santosgagbegnon
Copy link

Hey @ElMassimo, is it possible to update the next branch to be based off the latest version of vite_rails? It looks like it's currently based off of the v3.0.8 which was released in 2022.

I'd like to use the Subresource integrity feature, but also need some of the fixes & features that were introduced in later releases (example)

Thanks!

@renchap
Copy link

renchap commented Jan 7, 2024

Hi there!

Any news on this feature? Is there something I can do to help?

I am working on replacing Webpacker with Vite for Mastodon (see mastodon/mastodon#24981) and SRI is a requirement for us.

@mjankowski
Copy link
Contributor

Also curious here ... this feature seems like it's been done for ~2+ years, but hasn't been released yet?

Are you still hesitant to ship 4.0 with JUST this? If so, are you open to PRs that try to fold it into 3.x?

Separately - are there any other changes queueud up (I see some ruby version support changes in last few months, 3.0 is now EOL, etc...) which might help justify a 4.0?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request planned: 4.0 To be released in 4.0
Projects
None yet
Development

No branches or pull requests

6 participants