CSP hash reporting keywords

[yoavweiss]

WebKittens

@annevk

Title of the proposal

Hash reporting for scripts

URL to the spec

w3c/webappsec-csp#693

URL to the spec's repository

https://github.com/w3c/webappsec-csp/

Issue Tracker URL

No response

Explainer URL

w3c/webappsec-csp#693 (comment)

TAG Design Review URL

w3ctag/design-reviews#1020

Mozilla standards-positions issue URL

mozilla/standards-positions#1129

WebKit Bugzilla URL

No response

Radar URL

No response

Description

This feature adds a new CSP directive "report-hash", which triggers a new reporting type "csp-hash-report".
It reports hashes for (same-origin or CORS enabled) scripts that are loaded in the context of the document (regardless of their "integrity" attribute), and sends reports about them.

Those reports enable developers to:

• Create inventory of the scripts running on their page. (critical for PCI-DSS v4 - context.)
• Have certainty that they can enable SRI or CSP hash-based enforcement without breaking their sites. For some hash-based enforcement, we'd also need to add reporting for inline scripts, evals, event handlers and javascript URLs that are not covered by the current spec PR.

[yoavweiss]

Relevant WebKit bug