3.2.1 Agility

Multiple sets of integrity metadata may be associated with a single resource in order to provide agility in the face of future cryptographic discoveries. For example, the resource described in the previous section may be described by either of the following hash expressions:

sha384-dOTZf16X8p34q2/kYyEFm0jh89uTjikhnzjeLeF0FHsEaYKb1A1cv+Lyv4Hk8vHd
sha512-Q2bFTOhEALkN8hOms2FKTDLy7eugP2zFZ1T8LCvX42Fp3WoNr3bjZSAHeOsHrbV1Fu9/A0EzCinRE7Af1ofPrw==

Authors may choose to specify both, for example:

<script src="hello_world.js"
   integrity="sha384-dOTZf16X8p34q2/kYyEFm0jh89uTjikhnzjeLeF0FHsEaYKb1A1cv+Lyv4Hk8vHd
              sha512-Q2bFTOhEALkN8hOms2FKTDLy7eugP2zFZ1T8LCvX42Fp3WoNr3bjZSAHeOsHrbV1Fu9/A0EzCinRE7Af1ofPrw=="
   crossorigin="anonymous"></script>

In this case, the user agent will choose the strongest hash function in the list, and use that metadata to validate the response (as described below in the “parse metadata” and “get the strongest metadata from set” algorithms).

When a hash function is determined to be insecure, user agents SHOULD deprecate and eventually remove support for integrity validation using the insecure hash function. User agents MAY check the validity of responses using a digest based on a deprecated function.

To allow authors to switch to stronger hash functions without being held back by older user agents, validation using unsupported hash functions acts like no integrity value was provided (see the “Does response match metadataList” algorithm below). Authors are encouraged to use strong hash functions, and to begin migrating to stronger hash functions as they become available.

3.2.2 Priority

User agents must provide a mechanism for determining the relative priority of two hash functions and return the empty string if the priority is equal. That is, if a user agent implemented a function like getPrioritizedHashFunction(a, b) it would return the hash function the user agent considers the most collision-resistant. For example, getPrioritizedHashFunction('sha256', 'sha512') would return 'sha512' and getPrioritizedHashFunction('sha256', 'sha256') would return the empty string.

3.3.1 Apply algorithm to response

1. Let result be the result of applying algorithm to the representation data without any content-codings applied, except when the user agent intends to consume the content with content-encodings applied. In the latter case, let result be the result of applying algorithm to the representation data.
2. Let encodedResult be result of base64-encoding result.
3. Return encodedResult.

3.3.2 Is response eligible for integrity validation

In order to mitigate an attacker’s ability to read data cross-origin by brute-forcing values via integrity checks, responses are only eligible for such checks if they are same-origin or are the result of explicit access granted to the loading origin via Cross Origin Resource Sharing [CORS].

The following algorithm details these restrictions:

1. Let response be the response that results from fetching the resource.
2. If the response type is basic, cors or default, return true.
3. Return false.

3.3.3 Parse metadata.

This algorithm accepts a string, and returns either no metadata, or a set of valid hash expressions whose hash functions are understood by the user agent.

1. Let result be the empty set.
2. Let empty be equal to true.
3. For each token returned by splitting metadata on spaces:
   1. Set empty to false.
   2. If token is not a valid metadata, skip the remaining steps, and proceed to the next token.
   3. Parse token per the grammar in integrity metadata.
   4. Let algorithm be the alg component of token.
   5. If algorithm is a hash function recognized by the user agent, add the parsed token to result.
4. Return no metadata if empty is true, otherwise return result.

3.3.4 Get the strongest metadata from set.

1. Let result be the empty set and strongest be the empty string.
2. For each item in set:
   1. If result is the empty set, add item to result and set strongest to item, skip to the next item.
   2. Let currentAlgorithm be the alg component of strongest.
   3. Let newAlgorithm be the alg component of item.
   4. If the result of getPrioritizedHashFunction(currentAlgorithm, newAlgorithm) is the empty string, add item to result. If the result is newAlgorithm, set strongest to item, set result to the empty set, and add item to result.
3. Return result.

3.3.5 Does response match metadataList?

1. Let parsedMetadata be the result of parsing metadataList.
2. If parsedMetadata is no metadata, return true.
3. If response is not eligible for integrity validation, return false.
4. If parsedMetadata is the empty set, return true.
5. Let metadata be the result of getting the strongest metadata from parsedMetadata.
6. For each item in metadata:
   1. Let algorithm be the alg component of item.
   2. Let expectedValue be the val component of item.
   3. Let actualValue be the result of applying algorithm to response.
   4. If actualValue is a case-sensitive match for expectedValue, return true.
7. Return false.

This algorithm allows the user agent to accept multiple, valid strong hash functions. For example, a developer might write a script element such as:

<script src="https://example.com/example-framework.js"
        integrity="sha384-Li9vy3DqF8tnTXuiaAJuML3ky+er10rcgNR/VqsVpcw+ThHmYcwiB1pbOxEbzJr7
                   sha384-+/M6kredJcxdsqkczBUjMLvqyHb1K/JThDXWsBVxMEeZHEaMKEOEct339VItX1zB"
        crossorigin="anonymous"></script>

which would allow the user agent to accept two different content payloads, one of which matches the first SHA384 hash value and the other matches the second SHA384 hash value.

3.6.1 HTMLLinkElement

partial interface HTMLLinkElement {
                    attribute DOMString integrity;
};

3.6.2 HTMLScriptElement

partial interface HTMLScriptElement {
                    attribute DOMString integrity;
};

3.8.1 The link element for stylesheets

Whenever a user agent attempts to obtain a resource pointed to by a link element that has a rel attribute with the keyword of stylesheet, modify step 4 to read:

Do a potentially CORS-enabled fetch of the resulting absolute URL, with the mode being the current state of the element’s crossorigin content attribute, the origin being the origin of the link element’s Document, the default origin behavior set to taint, and the integrity metadata of the request set to the value of the element’s integrity attribute.

3.8.2 The script element

Replace step 14.1 of HTML5’s “prepare a script” algorithm with:

1. Let src be the value of the element’s src attribute and the request’s associated integrity metadata be the value of the element’s integrity attribute.