Add recommendation to use SRI for versioned & stable resources

[mozfreddyb]

I assumed this was a given, but apparently people are surprised and don't really know or understand what should happen when SRI fails.

We should add a note that recommends more clearly...
a) what an SRI violation means (the file you thought you were loading does not laod anymore because its content changed)
b) how to deal with it gracefully (host a copy someplace else and listen for error events on the script, maybe?)

[robinwhittleton]

The examples in the page should also be updated to generally include a v1.0 path or something like that, following the example of https://w3c.github.io/webappsec-subresource-integrity/#example-af0f59ce.

[robinwhittleton]

I’m not sure of the process here, but I’m happy to put together a proposal and PR it for comments?

[mikewest]

SGTM. I'll happily help review a patch.

[robinwhittleton]

Not sure if it notified anyone, but a patch is waiting @mikewest for when you have time. Zero rush of course 🙂

[mikewest]

Thanks for the ping! I added a few comments there.

[bchapuis]

@mozfreddyb @robinwhittleton You may be interested in a study we published last year about the web developer experience with SRI. It included a survey (section 5.5) related to the meaning of an SRI violation. It included a couple of questions such as:

• What happens when an integrity attribute has 2 or more valid hash values created with different algorithms?
• What happens when an integrity attribute has 2 or more valid hash values generated with the same algorithm?
• What happens if the digest in an integrity attribute is malformed (i.e., unsupported algorithm, nonbase64)?

The results where quite interesting and confirm the need for providing good examples in the specification.

[robinwhittleton]

Thanks! I’ll review these.

[mozfreddyb]

@bchapuis Thank you for conducting and sending us the study! Do you want to transform the proposed next steps from your paper into GitHub issues? We're not working on SRI improvements with a high priority, but getting individual things (like this one here) into the spec should be non-trivial if done incrementally.