Bug 326341

Summary:

importmap integrity key is broken in Safari

Product:

WebKit

Reporter:

johannes

Component:

Page Loading

Assignee:

Nobody <webkit-unassigned>

Status:

RESOLVED DUPLICATE

Severity:

Blocker

CC:

beidson, ntim

Priority:

Version:

Safari 26

Hardware:

All

OS:

All

Attachments:

Description	Flags
python script to reproduce the bug	none

johannes

Reported 2026-10-05 06:22:52 PDT

Greetings from the Django community! While working on DEP0021 (Django's support for SRI), I found a bug in Safari. With "Integrity-Policy: blocked-destinations=(script)", Safari blocks each module that a script imports through an import map. This also occurs when the import map has the integrity hash of that module. Steps to Reproduce: 1. Save repro.py (this directory) and run "python3 repro.py". 2. Open http://127.0.0.1:8000/ in Safari 26.6. The page stays blank. Console shows an error. 3. Open the same URL in Chrome 154 or Firefox. The page shows "ran". Subresource Integrity (SRI) and importmaps are both considered "widely-available", which is why I submitted this as a blocker. It goes to show how low real-life adoption is. However, the Django community hopes to close that gap. Hope, you have a lovely day! -Joe

Attachments
python script to reproduce the bug (1.53 KB, text/x-python-script) 2026-10-05 07:03 PDT, johannes	no flags	Details
View All Add attachment proposed patch, testcase, etc.

johannes

Comment 1 2026-10-05 07:03:15 PDT

Created attachment 481678 [details] python script to reproduce the bug

Tim Nguyen (:ntim)

Comment 2 2026-10-05 08:50:53 PDT

*** This bug has been marked as a duplicate of bug 326340 ***

Note You need to log in before you can comment on or make changes to this bug.