ihashgen

Generate Intergrity hash for the use of CDN, which can be used via CLI or Node packages. (Haven't tested on web)

Name: ihashgen

npmjs

Version

Stable

• [email protected]
• [email protected] [Added typings]
• [email protected] [Added inquirer]
• [email protected] [Code refactor]
• [email protected] [Shows file sizes in bytes]

Why use SRI?

https://news.ycombinator.com/item?id=14111499

unpkg website was compromised, so you don't want to risk your website to be phished or whatsoever, a simple intergrity hash check will solve this issue.

Problem Solved

Initially, I wanted to use unpkg for cdn alongside alongside with checksum for intergrity, but I found out that I need to run follwing bash command in order to generate hash. Therefore, I decided to write a CLI tools to "automate" that.

curl https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css | openssl dgst -sha384 -binary | openssl base64 -A

With intergrity checksum, eventhough the CDN is compromised, but your website are still safe from it.

console on webpage when the checksum is not the same

Inspired from srihash.org

Usage

Installation

Install with npm or yarn

npm install -g ihashgen # yarn global add ihashgen

Using it

as Dependency

node.js

ihashgen is a function in typescript

const intergrityGen: (
  url: string,
  type?: "css" | "js" | undefined,
  algo?: "sha384" | undefined
) => Promise<{
  hash: string;
  html: string;
}>;

CLI tools

General

> ihashgen --version
1.1.3
> ihashgen --help
Usage: ihashgen [options] [command]

Options:

  -V, --version                   output the version number
  -h, --help                      output usage information

Commands:

  generate|g [options] <cdn_url>  generate links based on url given

Generate

use ihashgen g <cdn_url> or ihashgen generate <cdn_url>

> ihashgen g --help
Usage: generate|g [options] <cdn_url>

generate links based on url given

Options:

  -t, --type [css/js]  specify file type (css/js)
  -a, --algo [sha384]  specify hashing algorithm (sha384)
  -h, --help           output usage information

Use command ihashgen generate <cdn_url>,

• -t or --type (file type) is set to default to check the url string ends with js or css
• -a or --algo (hashing algorithm used) is set to sha384

> ihashgen g https://unpkg.com/[email protected]/umd/react.production.min.js -t js -a sha384
Generatring hashes for [https://unpkg.com/[email protected]/umd/react.production.min.js]
Done hashing 🔑
Hash:  hqL/av/jdhwexbPMcoB6jzLfvBwAgAo5jKJzMpirHW+FBIg769b9IP70lr90RZm0
Html:  <script src="https://unpkg.com/[email protected]/umd/react.production.min.js" integrity="sha384-hqL/av/jdhwexbPMcoB6jzLfvBwAgAo5jKJzMpirHW+FBIg769b9IP70lr90RZm0" crossorigin="anonymous"></script>

Library

• Typescript
• Node.js

CLI

• commander
• chalk
• ora
• inquirer

Test

• Jest

Library used

• Crypto-Js
• Axios

Development

• yarn test to run unit test.
• yarn prod to generate for NPM. (This command works on Linux/Unix based machine)
• yarn sample to run a sample cli command to ihashgen

Roadmaps

• Support other hashing algorithm
• Better CLI with inquirer
• Create webpack configuration for dynamic-cdn-webpack-plugin

License

MIT