example of `require-sri-for`

w3c · a3fe14f88d3e60a0ca413bb4f1bacbe6217d81d6 · shekyan committed May 23, 2016 · May 23, 2016 · a3fe14f
1 parent 4dbb255
commit a3fe14f88d3e60a0ca413bb4f1bacbe6217d81d6
Unified Split

Showing with 21 additions and 0 deletions.

+21 −0 index.bikeshed.bs
diff --git a/index.bikeshed.bs b/index.bikeshed.bs
@@ -426,6 +426,27 @@ Given a <a>request</a> (|request|) and a <a>policy</a> (|policy|):
 
 3.  Return "Allowed".
 
+<div class="example">
+  A page with the following Content Security Policy:
+
+  <pre>
+    Content-Security-Policy: <a>require-sri-for</a> script style
+  </pre>
+
+  is equivalent to Content Security Policy delivered through <meta>
+  element:
+
+  <pre>
+    &lt;meta http-equiv="Content-Security-Policy"
+          content="<a>require-sri-for</a> script style"&gt;
+  </pre>
+
+
+  and requires <a>integrity metadata</a> be present in `script`
+  and `link` HTML elements that contain `src` attribute.
+</div>
+
+
 ## Response verification algorithms ## {#response-verification-algorithms}
 
 ### Apply |algorithm| to |response| ### {#apply-algorithm-to-response}