integrity

README

stakmachine/integrity

stackmachine/integrity makes it easy to enable subresource integrity for your web applications.

Install

dep ensure github.com/stackmachine/integrity

Usage

package main

import (
    "fmt"

    "github.com/stackmachine/integrity"
)

func main() {
    // Calculate SHA512 digests for all your static assets
    fs, err := integrity.ParseFiles("static")
    if err != nil {
        panic(err)
    }

    // Return the digest for a given file path, returning an error if it
    // doesn't exist.
    sha, err := fs.Digest("css/style.css")
    if err != nil {
        panic(err)
    }

    // Set the `integrity` parameter on a script or link element
    fmt.Printf(`<script type="javascript" integrity="%s" src="...">`, sha)
}

The integrity package also ships with a http.Handler that checks if an included digest is valid.

package main

import (
    "net/http"
    
    "github.com/stackmachine/integrity"
)

func main() {
    fs, err := integrity.ParseFiles("static")
    if err != nil {
        panic(err)
    }

    handler := http.FileServer(http.Dir("testdata"))
    handler = integrity.Verify(handler, fs)
    handler = http.StripPrefix("/static/", handler)

    // 200 - GET /static/css/style.css 
    // 200 - GET /static/css/style.css?sha=sha512-valid
    // 404 - GET /static/css/style.css?sha=sha512-invalid
    http.ListenAndServe(handler, nil)
}

Documentation

Index

• type FileSet
  • func ParseFiles(root string) (*FileSet, error)
  • func (b *FileSet) Digest(p string) (string, error)
• type Verifier
  • func Verify(b *FileSet, next http.Handler) *Verifier
  • func (v *Verifier) ServeHTTP(w http.ResponseWriter, r *http.Request)

Types

type FileSet

type FileSet struct {
	// contains filtered or unexported fields
}

func ParseFiles

func ParseFiles(root string) (*FileSet, error)

We're not actually parsing anything

func (*FileSet) Digest

func (b *FileSet) Digest(p string) (string, error)

type Verifier

type Verifier struct {
	// Query parameter that contains the SHA512 integrity value. Defaults to
	// "sha".
	Param string

	// If an integrity value is provided and it doesn't match the file, return
	// a 404 using this handler. Defaults to http.NotFoundHandler
	NotFound http.Handler
	// contains filtered or unexported fields
}

func Verify

func Verify(b *FileSet, next http.Handler) *Verifier

func (*Verifier) ServeHTTP

func (v *Verifier) ServeHTTP(w http.ResponseWriter, r *http.Request)