Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add integrity to LogRocket loading #866

Closed
travjenkins opened this issue Dec 12, 2023 · 1 comment
Closed

Add integrity to LogRocket loading #866

travjenkins opened this issue Dec 12, 2023 · 1 comment
Labels
keep an eye Tickets that might need to be reopened with more research / evidence Security Security Related wontfix This will not be worked on

Comments

@travjenkins
Copy link
Member

We need to include the integrity tag when loading in LogRocket.
@travjenkins travjenkins added the Security Security Related label Dec 12, 2023
@travjenkins travjenkins self-assigned this Dec 12, 2023
@travjenkins travjenkins mentioned this issue Jan 3, 2024
Merged
@travjenkins
Copy link
Member Author

Dug into this and do not believe we can do this today. We have added some scripts to keep an eye on how often the hash would change... but it can change at any time.

I have requested LogRocket add a feature to include the integrity hash when they are importing their JS dynamically.

Also, I have looked into several other 3rd party providers and many of them have flat out refused to add support for SRI.

I think for LogRocket our best approach will be to setup a proxy server.

@travjenkins travjenkins added wontfix This will not be worked on keep an eye Tickets that might need to be reopened with more research / evidence labels Jan 5, 2024
@travjenkins travjenkins removed their assignment Jan 10, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
keep an eye Tickets that might need to be reopened with more research / evidence Security Security Related wontfix This will not be worked on
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@travjenkins