ember-paper: Failed to find a valid digest in the 'integrity' attribute for resource

I get this error on heroku (not locally)

Failed to find a valid digest in the 'integrity' attribute for resource 'http://rubyissues.herokuapp.com/assets/rubyissues-dc683ef8d41f45e5fdafceda1a26598f.css' with computed SHA-256 integrity 'vGH6uxiZBXnDr46nPJPx2/V82if1Sij2FDhPgXSk6xI='. The resource has been blocked.

It seems to be similar to this: https://github.com/ember-cli/ember-cli/issues/5040, but I can not fix it by adding an empty integrity attribute to the link tag. (I can see another integrity attribute is added automatically)

I am posting here because I broke the issue down to one of the @import statements in my app.scss: The @import 'ember-paper'; - When I remove this line its working.

Seems to be an issue in chrome only. No problem when using Firefox.

About this issue

Original URL
State: closed
Created 9 years ago
Comments: 17 (8 by maintainers)

Commits related to this issue

Disable ember-cli-sri for now https://github.com/miguelcobain/ember-paper/issues/224 — committed to elwayman02/ember-data-echonest by elwayman02 8 years ago

Most upvoted comments

I had a similar issue running in production, and just ended up adding the empty integrity tag to every script and link tag. It resolved it for me. Don’t think there’s much we can do on our end here.

Here is what my index works, and this is working fine for me. Did you add it to all tags?

Note I haven’t tested with the latest ember-cli, but this is working for me

<!DOCTYPE html>
<html>
  <head>
    <meta charset="utf-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <title>Client</title>
    <meta name="description" content="">
    <meta name="viewport" content="width=device-width, initial-scale=1">

    {{content-for 'head'}}

    <link rel="stylesheet" href="assets/vendor.css" integrity="">
    <link rel="stylesheet" href="assets/client.css" integrity="">

    {{content-for 'head-footer'}}
  </head>
  <body layout="row">
    {{content-for 'body'}}

    <script src="assets/vendor.js" integrity=""></script>
    <script src="assets/client.js" integrity=""></script>

    {{content-for 'body-footer'}}
  </body>
</html>

+13

mike1o1 on Nov 14, 2015

I ran into this same issue today (css files fail for SRI check in any browser when using ember cli 2.4 and ember paper). Here is what I discovered…

ember-paper runs autoprefixer in a postprocessTree hook. ember-cli-sri runs its magic in the same hook. Because ember-cli-sri was before ember-paper in my package.json, sri runs before autoprefixer. Oops.

As a short term fix, rather than blank the integrity attribute you can move ember-paper before ember-cli-sri in your package json.

I’ll submit a PR shortly to ensure that ember-paper installs after ember-cli-sri so that the package.json order doesn’t matter.

chbonser on Apr 14, 2016

See PR #337. The build failed but it doesn’t look like something that I caused. Please let me know if you need anything else from me.

chbonser on Apr 14, 2016

@chbonser: Just planning ahead. 😜 Yes.

DanChadwick on Apr 14, 2016

@mansona you will have trouble in old Chrome’s if you don’t have >1.1 anyway as that was actually Chromes issue. Removing security really isn’t a good solution here please can I ask you not to advocate that. The bug you linked to talks about the issue there.

However all these issues are gone and actually ember-cli-sri is back in the stance of never disabling itself any more as Chrome has a stable implementation of SRI. Can I ask all three of you to ember install ember-cli-sri@2.0.0? Also removing any integrity=""'s from files unless they are generated on the fly (like testem.js)

That way you all get better security and this issue can be closed if it’s ok. 😄

jonathanKingston on Jan 27, 2016