Support ajax script attributes (e.g. for SRI or CSP)

@razamirza mentioned here: jquery/codeorigin.jquery.com#20 (comment)

Is there any plan to add support for SRI to jQuery.getScript()? http://api.jquery.com/jQuery.getScript/

I think it would be worth considering adding support to check a script on the outside, however probably this is worthy of an extension until all browsers support fetch+SRI/WebCrypto natively.

Author: Fantashit

1 thought on “Support ajax script attributes (e.g. for SRI or CSP)

  1. I’d prefer we just add options to jQuery.ajax() that let you set attributes on the tag before it is added to the DOM. So something like this:

    $.ajax({
      dataType: "script",
      url: "https://some/path",
      attrs: { nonce: "EDNnf03nceIOfn39fn3e9h3sdfa" },
    });

    which would inject a tag like:

    <script nonce="EDNnf03nceIOfn39fn3e9h3sdfa" src="https://some/path">

    I suppose we could have jQuery.getScript( url, [, attrs] [, success] ) as well. The implementation would end up mapping any jQuery.getScript() call into jQuery.ajax() anyway since this additional information has to make it all the way to the script transport.

Comments are closed.