Ember-cli-sri
What is it
This plugin is used to generate Subresource Integrity (SRI) hashes for ember applications.
Subresource integrity is a security concept used to check JavaScript and stylesheets are loaded with the correct content when using a CDN.
Why
The reason to add this to your application is to protect against poisoned CDNs breaking JavaScript or CSS subresources.
Installation
ember install ember-cli-sri
Configure
In Brocfile.js
or ember-cli-build.js
:
var app = new EmberApp({
});
- Without fingerprinting Ember will default to using relative URLs
- All relative paths will be given an integrity attribute which will make compliant browsers check content matches
Or:
var app = new EmberApp({
SRI: {
crossorigin: 'anonymous'
},
fingerprint: {
prepend: 'https://subdomain.cloudfront.net/'
}
});
- If your applications origin is different to where your subresources load from you will need to use CORS
- Your subresources will need to be served with CORS headers
- You will need to specify
SRI.crossorigin
Or:
var app = new EmberApp({
origin: 'https://subdomain.cloudfront.net/',
fingerprint: {
prepend: 'https://subdomain.cloudfront.net/'
}
});
- If you like absolute URLs in your HTML then let the addon know by specifying a
origin
attribute
Options
- origin - set to the URL the Ember app is served from (Example: https://example.com)
- SRI
- crossorigin - adds a crossorigin attribute to script and link elements
- This is required for CORS resources, values are:
- runsIn - default: ['production', 'test']
- enabled - default: true
- paranoiaCheck - default: true
- fingerprint
- prepend - resources with a full path will only get an applied integrity if the md5 checksum passes
Example output
<script src="https://example.com/thing-5e1978f9cfa158d9841d7b6d8a4e5c57.js" integrity="sha256-oFeuE/P+XJMjkMS5pAPudQOMGJQ323nQt+DQ+9zbdAg= sha512-+EXjzt0I7g6BjvqqjkkboGyRlFSfIuyzY2SQ43HQKZBrHsjmRzEdjSHhiDzVs30nXL9H0tKw6WbMPc6RfzUumQ==" crossorigin="anonymous" /></script>
<script src="https://example.com/thing-5e1978f9cfa158d9841d7b6d8a4e5c57.js" crossorigin="use-credentials" integrity="sha256-oFeuE/P+XJMjkMS5pAPudQOMGJQ323nQt+DQ+9zbdAg= sha512-+EXjzt0I7g6BjvqqjkkboGyRlFSfIuyzY2SQ43HQKZBrHsjmRzEdjSHhiDzVs30nXL9H0tKw6WbMPc6RfzUumQ=="/></script>
<script src="unicode-chars.js" integrity="sha256-TH5eRuwfOSKZE0EKVF4WZ6gVQ/zUch4CZE2knqpS4MU= sha512-eANuTl8NOQEa4/zm44zxX6g7ffwf6NXftA2sv4ZiQURnJsfJkUnYP8XpN2XVVZee4SjB32i28WM6trs9HVgQmA=="/></script>
Fail safe
This addon should fail safely at all times so resources matching https?
need:
- Asset URL needs to start with
fingerprint.prepend
- Asset must use fingerprinting with md5
- Asset must match md5 sum to what is in the filesystem
- An
SRI.crossorigin
attribute must be set or a matching origin
to fingerprint.prepend
If the config is not set correctly it should result in just a lack of SRI protection, which is better than a broken website.
Please file bugs if you find a case when the config doesn't 'fail safe', is not clear or results in a broken page.
Gotchas
-
If your Ember application is NOT being loaded on the same origin as in fingerprint.prepend
:
- The
fingerprint.prepend
domain will need to be serving CORS Headers
-
If your Ember application is being loaded on the same origin as in fingerprint.prepend
:
- Setting the crossorigin attribute isn't advised unless origin is serving CORS Headers
-
In code that uses SRI, you MUST NOT tamper with the built output JavaScript files as code will not load.
Crossorigin attribute
When the request doesn't match Same Origin Policy the crossorigin attribute MUST be present for the integrity of the file to be checked.
With an integrity set on an external origin and a missing crossorigin the browser will choose to 'fail-open' which means it will load the resource as if the integrity attribute was not set.
Values:
- anonymous - A cross-origin request (i.e., with Origin: HTTP header) is performed. But no credentials are sent (i.e., no cookie, no X.509 certificate, and no HTTP Basic authentication is sent). If the server does not give credentials to the origin site (by not setting the Access-Control-Allow-Origin: HTTP header), the resource will be tainted and its usage restricted.
- use-credentials - A cross-origin request (i.e., with Origin: HTTP header) performed with credentials (i.e., a cookie, a certificate, and HTTP Basic authentication is performed). If the server does not give credentials to the origin site (through Access-Control-Allow-Credentials: HTTP header), the resource will be tainted and its usage restricted.
'Fail-open' vs 'Fail-close'
- The current implementation in Chrome 'fails-open' resources that don't set the correct
crossorigin
attribute, this will be changed to 'fail-close' which is simpler to debug. - Browsers will still however 'fail-open' on cross origin resources that don't match the integrity attribute but don't send the correct CORS headers.
- This is because an attacker could check the integrity of authenticated only files or files behind a firewall.
- Browsers that don't support integrity checking will fail-open so it is a safe property to use if configured correctly.
'paranoiaCheck'
This addon will always take the default pain free stance; so this has been enabled by default until the issue is resolved.
Currently there is an encoding issue based on certain characters which is still being debugged when using Chrome.
This check fails if there is any non ASCII characters. On failure the file won't have a integrity attribute added.
Please note this will be removed as a default in the future; with the desire to remove all of the checking code too.
Browser support
- Chrome 45
- Firefox stable 42
Notes:
- Please verify Ember applications in supporting browsers, paying close attention to console messages
- No known formal objections to the specification
Running Tests