An Empirical Study of the Use of Integrity Verification Mechanisms for Web Subresources

Abstract

Web developers can (and do) include subresources such as scripts, stylesheets and images in their webpages. Such subresources might be stored on content delivery networks (CDNs). This practice creates security and privacy risks, should a subresource be corrupted. The subresource integrity (SRI) recommendation, released in mid-2016 by the W3C, enables developers to include digests in their webpages in order for web browsers to verify the integrity of subresources before loading them. In this paper, we conduct the rst large-scale longitudinal study of the use of SRI on the Web by analyzing massive crawls (≈3B URLs) of the Web over the last 3.5 years. Our results show that the adoption of SRI is modest (≈3.40%), but grows at an increasing rate and is highly in uenced by the practices of popular library developers (e.g., Bootstrap) and CDN operators (e.g., jsDelivr). We complement our analysis about SRI with a survey of web developers (=227): It shows that a substantial proportion of developers know SRI and understand its basic functioning, but most of them ignore important aspects of the recommendation. The results of the survey also show that the integration of SRI by developers is mostly manual-hence not scalable and error prone. This calls for a better integration of SRI in build tools. CCS CONCEPTS • Security and privacy → Web protocol security; Hash functions and message authentication codes.

Who's Hosting the Block Party? Studying Third-Party Blockage of CSP and SRI

“…While SRI is used on a total of 1,562 sites, we found that 626 of these only used SRI to pin popular libraries, virtually all of which were jQuery or Bootstrap (in line with what Chapuis et al [4] found). We attribute this fact mainly to the inclusion advice on the homepages of both projects, which supply HTML code snippets already, including the integrity attribute.…”

“…Naturally, allowing any subdomain of a given domain increases the chances of such an endpoint being allowed. As examples show 4 , such endpoints are often contained on subdomains of widelyincluded domains, e.g., on detector.alicdn.com.…”

“…Nevertheless, even though the feature was added in 2016 to the CSP standard, it has not been adopted by many sites, and script-controlling policies are still as insecure as ever [27]. Similarly, while SRI's popularity is slowly increasing, this is primarily due to widespread libraries like jQuery [4], leaving many other resources susceptible to cause severe harm in case of compromised third parties.…”

A Study on the Use of Checksums for Integrity Verification of Web Downloads

“…And failures to address this issue can create detrimental false alarm situations. These issues are discussed in more details (for SRI) in a recent study [39].…”

“…A recent study by Chapuis et al [39] shows that web developers have a strong interest in extending SRI to downloads (i.e., a elements) as well as pictures, videos, etc. We made a proposal in this direction and communicated it to W3C's WebAppSec Working Group.…”