Zen Follower
- Join Date:
- Mar 2004
- Posts:
- 210
- Plugin Contributions:
- 0
SRi hash tags for jscript pages
Hello,
i understand this is a private post page
i am trying to get my zencart secure.
i ran a security check for tinfoil and i got this below.. but before i paste it I am starting to understand what i need to do...
so i need to generate a SRI hash code for my jscripts
and i am just not sure how to do that,.
I didn't know where else to put this post.
i know i have to to put it in the java script files under template.
but when i put in that address it comes back with no result.
ok here is what i got from the security place
tinfoil
VULNERABILITY: MISSING SUBRESOURCE INTEGRITY PROTECTION
DETAILS
Severity
URL
Variable
Element
Low
https://herasonlinemarket.com/shop/
https://maxcdn.bootstrapcdn.com/font-
awesome/4.7.0/css/font-awesome.min.css
body
DESCRIPTION
By loading non-integrity protected resources from an external server or CDN, it becomes possible for
an attacker to compromise that server, in order to serve your users malicious resources. This opens
you up to the possibility of cross-site scripting attacks, or other, similar vulnerabilities.
HOW TO FIX
All externally loaded resources must have their content pinned using the subresource integrity
mechanisms provided by modern browsers. This involves computing a hash of the contents of the
resource, and specifying this hash when loading that resource. In the case of a script, this might look
like the following:
SRI Hash is an option for computing the necessary hashes.
REFERENCES
SRI Hash - https://srihash.org/
W3 - Subresource Integrity - http://www.w3.org/TR/SRI/
Github - Subresource Integrity - http://githubengineering.com/subresource-integrity/
My Multi_Site Zen Carts
http://herasonlinemarket.com