Analytics
2.1K members online now
2.1K members online now
Dive into multiple domain (Cross/Sub) tracking, implementing Ecommerce and Enhanced Ecommerce, setting up Event tracking, and Universal Analytics code.
 
Guide Me
star_border
Reply

Google Analytics support for SRI hash?

Visitor ✭ ✭ ✭
# 1
Visitor ✭ ✭ ✭

I'd like to utilize SRI hashing for all of the external resources on my website.

 

Plugging https://www.google-analytics.com/analytics.js into https://www.srihash.org/ gives me "Error: this resource is not eligible for integrity checks. See http://enable-cors.org/server.html".

 

I know between updates to analytics I'd need to update the hash, but I'm not concerned about that. I'd rather it fail the hash check if it varies.

 

Is this a bug in the SRI spec, SRI implementation, or something else?

Google Analytics support for SRI hash?

Visitor ✭ ✭ ✭
# 2
Visitor ✭ ✭ ✭

*BUMP# Same issue here.

Re: Google Analytics support for SRI hash?

[ Edited ]
Visitor ✭ ✭ ✭
# 3
Visitor ✭ ✭ ✭

The problem with GA is it's 1 script which programmatically downloads other scripts.

 

So you can check the integrity of the 1st script - without being able to check or control integrity of all the others.  Thus defeating the purpose of SRI

 

SRI has limitations.