Enable Subresource Integrity

config/webpack/webpack.config.js

@@ -1,12 +1,14 @@
 // See the shakacode/shakapacker README and docs directory for advice on customizing your webpackConfig.
 
-const { webpackConfig, merge } = require('shakapacker')
+const { webpackConfig, config, merge } = require('shakapacker')
 const webpack = require('webpack');
 
 const CompressionPlugin = require("compression-webpack-plugin");
 const CssMinimizerPlugin = require("css-minimizer-webpack-plugin");
 const MiniCssExtractPlugin = require("mini-css-extract-plugin");
 const TerserPlugin = require("terser-webpack-plugin");
+const WebpackAssetsManifest = require('webpack-assets-manifest');
+const { SubresourceIntegrityPlugin } = require("webpack-subresource-integrity");
 
 // Custom ERB loader to disable Spring and prevent crashes
 const erb = require("./loaders/erb");
@@ -30,7 +32,9 @@ const envConfig = module.exports = {
         ],
     },
     output: {
-        publicPath: relative_url_root + public_output_path
+        publicPath: relative_url_root + public_output_path,
+        // the following setting is required for SRI to work:
+        crossOriginLoading: 'anonymous',
     },
     performance: {
         // Turn off size warnings for large assets
@@ -53,6 +57,15 @@ const envConfig = module.exports = {
         }),
         new CompressionPlugin(),
         new MiniCssExtractPlugin(),
+        new SubresourceIntegrityPlugin(),
+        new WebpackAssetsManifest({
+            entrypoints: true,
+            integrity: false,
+            writeToDisk: true,
+            entrypointsUseAssets: true,
+            publicPath: true,
+            output: config.manifestPath,
+        })
     ],
     resolve: {
         extensions: ['.css', '.ts', '.tsx'],
@@ -65,4 +78,8 @@ const envConfig = module.exports = {
     stats: 'minimal',
 }
 
+// Use the two lines below to remove the original WebpackAssetsManifest and replace it with our custom config.
+const filteredPlugins = webpackConfig.plugins.filter((plugin) => !(plugin instanceof WebpackAssetsManifest))
+webpackConfig.plugins = filteredPlugins;
+
 module.exports = merge(webpackConfig, envConfig)