WAICT enforcement modes #159

Compared to Integrity Policy with a report and enforce mode, with WAICT we propose three necessary enforcement modes. The modes are described in what follows and allow for gradual adoption of WAICT and finer control on what the browser should do when it detects a violation. We also propose one potential approach of how Integrity-Policy could enable these three modes.

strict : The resources will not be loaded/unlocked into the page if synchronous integrity check has not passed
normal: The page will be loaded and notifications will be sent asynchronus to the user to inform about the status of the check
report : The page will be loaded and notifications will be only sent to developers similar to report-uri

How to enable WAICT using Integrity Policy:

• Integrity-Policy with a blocked-destination set to a valid option of any or all of (script, style, html, wasm, etc…) is the equivalent of WAICT strict mode

• Integrity-Policy-Report-Only with a blocked-destination set to a valid option of any or all of (script, style, html, wasm, etc…) is the equivalent of WIACT report mode

• We propose the addition of a new Integrity-Policy attribute to enable WAICT normal mode

  • Integrity-Policy with a checked-destination set to a valid option of any or all of (script, style, html, wasm, etc…)

Example:

Integrity-Policy: 
  blocked-destinations=(script)
  checked-destinations=(wasm)  
  source=(<manifest_bundle_uri>)
  

Integrity-Policy-Report-Only: 
  blocked-destinations=(style,html)
  source=(<manifest_bundle_uri>)