CSP report-hash keyword

[yoavweiss]

Request for Mozilla Position on an Emerging Web Specification

• Specification title: Content-Security-Policy
• Specification or proposal URL (if available): Hash reporting for scripts w3c/webappsec-csp#693
• Explainer URL (if available): Hash reporting for scripts w3c/webappsec-csp#693 (comment)
• Proposal author(s) (@-mention GitHub accounts): @yoavweiss
• Caniuse.com URL (optional):
• Bugzilla URL (optional):
• Mozillians who can provide input (optional):
• WebKit standards-position:

Other information

This feature adds a new CSP directive "report-hash", which triggers a new reporting type "csp-hash-report".
It reports hashes for (same-origin or CORS enabled) scripts that are loaded in the context of the document (regardless of their "integrity" attribute), and sends reports about them.

Those reports enable developers to:

• Create inventory of the scripts running on their page. (critical for PCI-DSS v4 - context.)
• Have certainty that they can enable SRI or CSP hash-based enforcement without breaking their sites. For some hash-based enforcement, we'd also need to add reporting for inline scripts, evals, event handlers and javascript URLs that are not covered by the current spec PR.