Update fails due to failed integrity check

Support
1

Hi,

when I update my app, I always test it on a test site https://[…].netlify.app/. Maybe, it is relevant, that this is a Netlify subdomain.
When everything works, I publish it on my real site that is a Netlify site but runs on my custom domain.

It happened today for the first time, that I cannot update my app on the test site. The console tells me

Failed to find a valid digest in the ‘integrity’ attribute for resource ‘…netlify.app/index.html’ with computed SHA-256 integrity ‘dQPaWhmWLTgPeMWccIvQrgls7898MCz05zVoOqqP1GI=’. The resource has been blocked.
Fetch API cannot load ‘…netlify.app/index.html’. SRI’s integrity checks failed.

I tested the update on my real site and hey, it worked.

So, I examined the index.html. The wwwroot/index.html and the real site’s index.html are identical. But the test site’s index.html has an additional

!-- This site is hosted on Netlify. Anyone can build and deploy a site
like this one for free: Redirecting…
Netlify hosting facts for this site: static/SSR served via Netlify Edge. –

meta name=“hosting-provider” content=“Netlify”
meta name=“netlify-deploy” content=" Redirecting… "

Could this injected code make the integrity check fail? If yes, can it be deactivated?

Many thanks

Philipp

2

I’m having the same problem. Netlify is sneaking this into new builds. Only God knows what they are going to do next with your sites in the future. They should have an announcement and option to disable this ffs.

3

Guys, I really need help. I cannot update my test site anymore.

I cleared all site data and was then able to load the latest version.
But then I published a further update, what is again not possible to load.

BR

Philipp

4

Push

And push a little further to reach 20 characters

6

Yes — if your service worker or update check pins an integrity hash for index.html, any injected HTML comment will change the digest and fail SRI. Custom domains may not get the same injection, which matches what you saw. Short term, stop hashing index.html itself (hash static assets instead) or clear cache after each deploy. Longer term you need an official way to disable that inject for *.netlify.app sites.

7

Thanks, alinay, for your response.

Sure, I can stop hashing index.html, but I think, Netlify should stop, injecting things.

Anyway, here are my code changes in service-worker.published.js, just in case anyone runs into the same problem:
Before:
async function onInstall(event) {
[...]
const assetsRequests = self.assetsManifest.assets
.filter(asset => offlineAssetsInclude.some(pattern => pattern.test(asset.url)))
.filter(asset => !offlineAssetsExclude.some(pattern => pattern.test(asset.url)))
.map(asset => new Request(asset.url, { integrity: asset.hash }));
await caches.open(cacheName).then(cache => cache.addAll(assetsRequests));
}

After:
async function onInstall(event) {
[...]
const integrityCheckExclude = [/index\.html$/];
const assetsRequests = self.assetsManifest.assets
.filter(asset => offlineAssetsInclude.some(pattern => pattern.test(asset.url)))
.filter(asset => !offlineAssetsExclude.some(pattern => pattern.test(asset.url)))
.map(asset => {
const skipIntegrity = integrityCheckExclude.some(pattern => pattern.test(asset.url));
return new Request(asset.url, skipIntegrity ? {} : { integrity: asset.hash });
});
await caches.open(cacheName).then(cache => cache.addAll(assetsRequests));
}

BR

Philipp