When CSS files have an SRI attribute they are downloaded twice.
Reported by
scott.he...@gmail.com,
Mar 3 2017
|
|||
Issue descriptionUserAgent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Steps to reproduce the problem: 1. Add a valid integrity attribute to a css file. 2. Load the page. 3. Observer the network tab in dev tools. What is the expected behavior? The file should not be loaded twice. What went wrong? For some reason the files seem to be loaded twice. I haven't had time to investigate why, there are no error messages about integrity checks failing for example, but SRI is a security mechanism so I added the security flag. If it doesn't turn out to be a security issue please feel free to remove the flag. I found out about the bug from a comment on Troy Hunt's blog: https://www.troyhunt.com/protecting-your-embedded-content-with-subresource-integrity-sri/#comment-3183394805 I've attached screenshots of the network tab for my site on both Firefox and Chrome. Chrome is loading all SRI protected CSS files twice, Firefox is not. My site: https://scotthelme.co.uk Did this work before? Yes Chrome version: 56.0.2924.87 Channel: stable OS Version: 10.0 Flash Version:
,
Mar 6 2017
Scott: Do you see this in Canary? yoav@: I think you were looking at something for `<link>`?
,
Mar 6 2017
Yeah, this is something we see with SRI, where it cannot properly handle resources that are taken out of MemoryCache.
,
Mar 6 2017
Yeah, I still see this on Canary. I'm not sure if this is something to do with loading from memory like the other issue suggests. The attached screenshot is a fresh install of Canary (never installed on this machine) and the first page it loaded was my blog and I still saw the double downloading of assets. Both of the requests show network activity and a 200 status.
,
Mar 6 2017
I believe it's the same issue. The preloadScanner is downloading the resource and putting it in MemoryCache. Then the DOM node for the resource is created, fails to grab the resource from MemCache and downloads it again (potentially getting it from the disk cache, if the resource is cacheable) |
|||
►
Sign in to add a comment |
|||
Comment 1 by elawrence@chromium.org
, Mar 3 2017Labels: -Type-Bug-Security -Restrict-View-SecurityTeam Type-Bug
Status: Untriaged (was: Unconfirmed)
Summary: When CSS files have an SRI attribute they are downloaded twice. (was: When CSS files have an SRI attribute they are loaded twice.)