I was wondering if it’s possible to include hashes of external files within a HTML file. This should basically serve 2 purposes:
- Including unencrypted content into encrypted pages. (The hashes would ensure the integrity of the data)
- Allow more caching for resources that are used on multiple pages
Let’s focus on the second case and clarify it with a made-up example:
<script type="text/javascript" src="jQuery-1.5.1.min.js" hash-md5="b04a3bccd23ddeb7982143707a63ccf9">
Browsers could now download and cache the file initially. For every following page that uses the same hash, it would be clear that the cached version could be used. This technique should work independent of file origin, file type, transmission protocol and without even hitting the server once to know that a file is already cached locally.
My question is: Is such a mechanism available in HTML?
The following example is just to clarify the idea further and does not add new information.
An example of a library included in 2 unrelated pages would lead to the following steps.
- User navigates to page A for the first time
- Browser loads page A and looks for external files (images, scripts, …)
- Browser finds page A includes a script with hash
b04a3bccd23ddeb7982143707a63ccf9 - Browser checks its cache and finds no file with that hash
- Browser downloads the file from the given URL (gives a file on page A’s domain)
- Browser calculates hash and compares it with the hash as stated on page A
- Browser adds file to its cache using the hash. If calculated hash would not have matched given hash, the file would have been rejected with an error message
- Browser executes file.
At some point later in time:
- User navigates to page B for the first time
- Browser loads page B and looks for external files (images, scripts, …)
- Browser finds page B includes a script with hash
b04a3bccd23ddeb7982143707a63ccf9 - Browser checks its cache and finds a file with that hash
- Browser loads file from cache. The browser did not care about the URL given on page B pointing to the file. Also, it did not matter how the file’s content found its way into the cache – protocol, encryption of connection and source are ignored. No connection to any server was made to load the file for page B
- Browser executes file.
It’s basically a kernel of a good idea, but I don’t think there’s anything in HTML to support it. Might be able to kludge something together with JavaScript, I suppose.