winjs-plugin-security
A plugin that provides security enhancements for WinJS projects, mainly used for generating SRI (Subresource Integrity) attributes.
Features
- Automatically generates SRI attributes for
andtags in HTML files - Supports SHA-256, SHA-384, and SHA-512 hash algorithms (configurable)
- Automatically adds
crossorigin="anonymous"attribute to ensure SRI works properly - Only effective in production environments, automatically skipped in development environments
Installation
pnpm add @winner-fed/plugin-security
Usage
Add the plugin configuration in your .winrc.ts configuration file:
import { defineConfig } from '@winner-fed/winjs';export default defineConfig({
plugins: ['@winner-fed/plugin-security'],
security: {
sri: true // 启用 SRI 功能
},
});
Configuration Options
sri
- Type:
boolean | { algorithm: 'sha256' | 'sha384' | 'sha512' } - Default: Must be set manually
- Description: Whether to enable SRI (Subresource Integrity) functionality and optional hash algorithm configuration
true or {}, the plugin will:- Scan the built HTML files
- Add
integrityattributes to alltags with asrcattribute - Add
integrityattributes to alltags with ahrefattribute - Automatically add
crossorigin="anonymous"attribute (if not present)
security: {
sri: {
algorithm: 'sha512' // 可选 'sha256' | 'sha384' | 'sha512',默认 'sha512'
}
}示例
输入 HTML
Output HTML (After Enabling SRI)
Safety Instructions
SRI (Subresource Integrity) is a security feature that allows browsers to verify that fetched resources (such as those from a CDN) have not been maliciously altered. When the browser loads a resource, it calculates the resource's hash and compares it with the hash specified in the integrity attribute. If the hashes do not match, the browser will refuse to load the resource.
For tags, this results in refusal to execute the code; for CSS links, it results in not loading the styles.
For more information about SRI, see Subresource Integrity - MDN.
Notes
- This plugin only takes effect during production builds; it is automatically skipped in the development environment
- Ensure that resource files are accessible in the build output directory
- The
integrityattribute must be used together with thecrossoriginattribute to work properly
License
MIT
--- Tranlated By Open Ai Tx | Last indexed: 2025-08-06 ---