SRI: are there more problematic headers?

[fmarier]

Section 3.3.2 lists the following headers as making the resource ineligible for integrity checks:

• Authorization or WWW-Authenticate
• Refresh

Consider the impact of other headers: Content-Length, Content-Range, etc. Is there danger there?

[annevk]

I think that section is largely bogus. Probably best to revisit it. Those headers would not exclude checks at all. This is why you need to fix Fetch integration.

[mozfreddyb]

To clarify: This means, if we integrate nicely with fetch, you will define the headers for us, so we do not have to?

[annevk]

I don't see what needs to be defined about those headers? But if something needs to happen, that would need to fall out of integrating with Fetch.

[devd]

Maybe we should just kill that section then? I think now that we have switched to requiring CORS, I don't see much point to this section either.

[hillbrad]

+1 to remove this section. Since you need to be able to see the contents of a response for it to be eligible at this point, making further distinctions about whether content was "authenticated" or not seems to be of no practical value.