Bug 326340

Summary:

importmap integrity key is broken in Safari

Product:

WebKit

Reporter:

johannes

Component:

Page Loading

Assignee:

Nobody <webkit-unassigned>

Status:

NEW

Severity:

Blocker

CC:

basuke, beidson, charliew, rik, rupin, webkit-bug-importer

Priority:

Keywords:

InRadar

Version:

Safari 26

Hardware:

All

OS:

All

Attachments:

Description	Flags
code sample to reproduce the error	none

johannes

Reported 2026-10-05 06:22:36 PDT

Created attachment 481671 [details] code sample to reproduce the error Greetings from the Django community! While working on DEP0021 (Django's support for SRI), I found a bug in Safari. With "Integrity-Policy: blocked-destinations=(script)", Safari blocks each module that a script imports through an import map. This also occurs when the import map has the integrity hash of that module. Steps to Reproduce: 1. Save repro.py (this directory) and run "python3 repro.py". 2. Open http://127.0.0.1:8000/ in Safari 26.6. The page stays blank. Console shows an error. 3. Open the same URL in Chrome 154 or Firefox. The page shows "ran". Subresource Integrity (SRI) and importmaps are both considered "widely-available", which is why I submitted this as a blocker. It goes to show how low real-life adoption is. However, the Django community hopes to close that gap. Hope, you have a lovely day! -Joe

Attachments
code sample to reproduce the error (1.53 KB, text/x-python-script) 2026-10-05 06:22 PDT, johannes	no flags	Details
View All Add attachment proposed patch, testcase, etc.

Tim Nguyen (:ntim)

Comment 1 2026-10-05 08:50:53 PDT

*** Bug 326341 has been marked as a duplicate of this bug. ***

Alexey Proskuryakov

Comment 2 2026-10-05 18:00:55 PDT

Thank you for the report! This reproduces in STP 253, too.

Radar WebKit Bug Importer

Comment 3 2026-10-12 06:23:14 PDT

<rdar://problem/189808062>

Note You need to log in before you can comment on or make changes to this bug.