Add support for Subresource Integrity

[tmaier]

Is your feature request related to a problem? Please describe.

Similar to rails/webpacker#323

Sprockets supported subresource integrity out of the box. It would be nice if

vite_javascript_tag 'application', integrity: true

worked the same.

Describe the solution you'd like
Calculate the hash for each file and add it to the relevant tags

Describe alternatives you've considered
None.

Additional context

• webpacker does not support it at the moment. This could be a nice differentiator. See Subresource Integrity rails/webpacker#323
• Github about SRI: https://github.blog/2015-09-19-subresource-integrity/

[ElMassimo]

@tmaier Given that this requires changes to public APIs in ViteRuby::Manifest, it will need to wait for the next major release.

Experimental support is available in the next branch, you can try it now by explicitly adding 4.0.0.alpha1 to your Gemfile:

gem 'vite_rails', '~> 4.0.0.alpha1'

You must also add vite-plugin-manifest-sri to your package.json and configure it in vite.config.ts:

import { defineConfig } from 'vite'
import RubyPlugin from 'vite-plugin-ruby'
import ManifestSRI from 'vite-plugin-manifest-sri'

export default defineConfig({
  plugins: [
    RubyPlugin(),
    ManifestSRI(),
  ],
})

[vladimirtemnikov]

@ElMassimo is this feature still not ready to release? Could be really helpful for security reasons.

[ElMassimo]

The implementation in 4.0.0.alpha1 lives in the next branch, and is "ready".

Given that this requires changes to public APIs in ViteRuby::Manifest, it will need to wait for the next major release.

This hasn't been a highly requested feature. I'm waiting for either breaking changes in Vite or something else that justifies releasing a new major.

[santosgagbegnon]

Hey @ElMassimo, is it possible to update the next branch to be based off the latest version of vite_rails? It looks like it's currently based off of the v3.0.8 which was released in 2022.

I'd like to use the Subresource integrity feature, but also need some of the fixes & features that were introduced in later releases (example)

Thanks!

[renchap]

Hi there!

Any news on this feature? Is there something I can do to help?

I am working on replacing Webpacker with Vite for Mastodon (see mastodon/mastodon#24981) and SRI is a requirement for us.

[mjankowski]

Also curious here ... this feature seems like it's been done for ~2+ years, but hasn't been released yet?

Are you still hesitant to ship 4.0 with JUST this? If so, are you open to PRs that try to fold it into 3.x?

Separately - are there any other changes queueud up (I see some ruby version support changes in last few months, 3.0 is now EOL, etc...) which might help justify a 4.0?

[smotraghi-shopify]

Hi @ElMassimo , just wanted to join the chorus of folks requesting an official release supporting SRI. Happy to help if necessary. Thanks so much!

[writercoder]

Hi, I believe this changes is needed for PCI v4 compliance in March 2025. I'm really happy with this library but I will have to look elsewhere if I can't implement SRI in good time for this deadline.

[VitalyEmelyanov]

Hello, are there any updates on this story? I think it's quite needed feature, would be nice to see it in the official release.