rictic on Revisiting the “Cookieless Domain” Recommendation

Comment on Revisiting the “Cookieless Domain” Recommendation parent

There's an emerging standard for specifying a hash for a resource, and potentially loading it from one of several locations, so long as it matches the given hash: http://www.w3.org/TR/SRI/

Animats 11y

That's a very good idea. There's more stuff in that TR than is strictly necessary, but the basic idea is

    <a href="https://example.com/file.zip"
     integrity="ni:///sha256;  
     skjdsfkafinqfb...ihja_gqg?
     ct=application/octet-stream"
     download>Download!</a>

That provides integrity checking without encryption. It also helps with caching - rather than expiration times, cache systems can use the hash. If you already have a copy of jquery in cache and it matches the hash, it doesn't matter where it came from.

Comments