mozilla/http-observatory-website

SRI failed because of external script

d0xx0b opened this issue · 1 comments

Hello,

2 days ago this was not a problem but since yesterday SRI fails on my site: "Subresource Integrity (SRI) not implemented, but all external scripts are loaded over HTTPS"
It says -5 points but subtracting 10 points.

Then i checked my site and it fails at this:
<script async defer src='https://maps.googleapis.com/maps/api/js?key=MY_API_KEY&callback=initMap' nonce='RANDOM_NONCE'></script>

The problem is that you can't add an SRI hash to this script since it's hosted at google and they don't allow CORS.

Its sad because every other script on my page has an SRI hash set.
Is there anything i can do other than removing google maps from my site?

Best,
d0xx0b

i'm closing this since i got no answer within 2 month.