Handling Subresource Integrity

Design Doc: PageSpeed Optimization Products and Subresource Integrity (SRI)

(Work in progress)

Introduction

Currently, PageSpeed optimization is unable to understand "integrity" html tag attributes or "Content-Security-Policy: require-sri-for [target];" type response headers. Ideally, the framework would be aware of these attributes. Because of this, pages may break when we alter resource content in the optimization process.

Also, see https://github.com/apache/incubator-pagespeed-mod/wiki/Design-Doc:-Brainstorming-PageSpeed-Optimization-Products-and-Content-Security-Policy

Interaction

Basically, PageSpeed Optimization has two modes of operation:

In-Place resource optimization.

We enhance delivery for resources like javascript, css, and images by serving a smaller, faster version. Responses will potentially be different per user-agent.

TODO(oschaaf): describe interaction.

HTML-contextual optimization (the default)

In this mode we apply changes to html and replace resource urls, where we also consider the html context, leading up to more optimization opportunities. We will generate different resource urls and responses for different user-agents.

TODO(oschaaf): describe interaction.

Going forward

At a high level:

1. The first step should be to make sure that we do not break pages by making them violate SRI integrity hashes. In the html flow, we can leave html tags with integrity attributes alone. The in-place flow may be challenging though.
2. The second step should be a filter that is able to strip input SRI attributes, but only if we can verify integrity on behalf of the user-agent.
3. The third step should be to add the capability of automatically adding integrity attributes
4. The last step should be to add integrity attributes on any of resources we inject ourselves.

TODO(oschaaf): think about CSP part to this.