topic Re: Why doesn't the ArcGIS JS API CDN have an integrity value? in ArcGIS JavaScript Maps SDK Questions

Why doesn't the ArcGIS JS API CDN have an integrity value?

JoeHeggenstaller — Tue, 03 Mar 2020 12:54:43 GMT

This is probably a really noob question that I've wondered about for years, but have never been able to determine a solid answer. Why doesn't the ArcGIS JS API CDN have Subresource Integrity hash (SHA256, SHA384) and crossorigin values? Similar to other libraries like jQuery?

<script src="https://code.jquery.com/jquery-3.4.1.min.js" integrity="sha256-CSXorXvZcTkaix6Yvo6HppcZGetbYMGWSFlBw8HfCJo=" crossorigin="anonymous"></script>

Thanks.

Re: Why doesn't the ArcGIS JS API CDN have an integrity value?

ChadCooper1 — Sun, 06 Dec 2020 16:23:48 GMT

@JuliePowell - could you help out here please? I've got the same question. Thanks.

Re: Why doesn't the ArcGIS JS API CDN have an integrity value?

JuliePowell — Tue, 08 Dec 2020 21:38:04 GMT

Hi Joe & Chad,

We don't advertise the hash because it may break when the CDN is patched. However, if you want to compute it, feel free to add it. If you have more questions about this, @DasaPaddock can help.

Julie

Re: Why doesn't the ArcGIS JS API CDN have an integrity value?

JoeHeggenstaller — Mon, 14 Dec 2020 12:46:35 GMT

Thanks Julie for the information. We'll check it out.