RESOLVED DUPLICATE of bug 326340326341
importmap integrity key is broken in Safari 
https://bugs.webkit.org/show_bug.cgi?id=326341
Summary importmap integrity key is broken in Safari
johannes
Reported 2026-10-05 06:22:52 PDT
Greetings from the Django community! While working on DEP0021 (Django's support for SRI), I found a bug in Safari. With "Integrity-Policy: blocked-destinations=(script)", Safari blocks each module that a script imports through an import map. This also occurs when the import map has the integrity hash of that module. Steps to Reproduce: 1. Save repro.py (this directory) and run "python3 repro.py". 2. Open http://127.0.0.1:8000/ in Safari 26.6. The page stays blank. Console shows an error. 3. Open the same URL in Chrome 154 or Firefox. The page shows "ran". Subresource Integrity (SRI) and importmaps are both considered "widely-available", which is why I submitted this as a blocker. It goes to show how low real-life adoption is. However, the Django community hopes to close that gap. Hope, you have a lovely day! -Joe
Attachments
python script to reproduce the bug (1.53 KB, text/x-python-script)
2026-10-05 07:03 PDT, johannes 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
johannes
Comment 1 2026-10-05 07:03:15 PDT
Created attachment 481678 [details] python script to reproduce the bug
Tim Nguyen (:ntim)
Comment 2 2026-10-05 08:50:53 PDT
*** This bug has been marked as a duplicate of bug 326340 ***
Note You need to log in before you can comment on or make changes to this bug.