Repository navigation
SRI page has no hash for custom domains #72
Description
What
The SRI page tells custom-domain users to load https://CUSTOM.DOMAIN/vN/app.js and generate the integrity hash themselves with a third-party site. The hash on the page only works for scripts.simpleanalyticscdn.com, because the custom-domain script contains the custom domain.
Customers also try the CDN path (/sri/vN.js) on their custom domain, which served latest.js until simpleanalytics/infrastructure#314 and broke their hash on the next release (simpleanalytics/infrastructure#312).
Why
Getting the custom-domain hash right takes manual steps and an outside tool, and a wrong URL breaks tracking silently on the next release.
Notes
Script responses on custom domains send Access-Control-Allow-Origin: *.
Activity