Subresource Integrity für IIS konfigurieren

# PowerShell — SRI-Hash generieren
# SHA-384 Hash für eine externe Ressource berechnen
$url = "https://cdn.example.com/lib.min.js"
$content = (Invoke-WebRequest -Uri $url).Content
$bytes = [System.Text.Encoding]::UTF8.GetBytes($content)
$hash = [System.Security.Cryptography.SHA384]::Create().ComputeHash($bytes)
$base64 = [Convert]::ToBase64String($hash)

Write-Host "sha384-$base64"

# Alternative mit openssl (Git Bash auf Windows):
# curl -s https://cdn.example.com/lib.min.js \
#   | openssl dgst -sha384 -binary | openssl base64 -A

# PowerShell — Mehrere Ressourcen auf einmal hashen
# Nuetzlich für Projekte mit vielen CDN-Abhaengigkeiten
$resources = @(
  "https://cdn.example.com/jquery-3.7.1.min.js",
  "https://cdn.example.com/bootstrap-5.3.3.min.css",
  "https://cdn.example.com/alpine-3.14.min.js"
)

foreach ($url in $resources) {
  $content = (Invoke-WebRequest -Uri $url).Content
  $bytes = [System.Text.Encoding]::UTF8.GetBytes($content)
  $hash = [System.Security.Cryptography.SHA384]::Create().ComputeHash(
    $bytes)
  $sri = "sha384-$([Convert]::ToBase64String($hash))"

  Write-Host "$url"
  Write-Host "  integrity=$sri"
  Write-Host ""
}

// ASP.NET Razor View — SRI mit TagHelper
// In _ViewImports.cshtml:
@addTagHelper *, Microsoft.AspNetCore.Mvc.TagHelpers

// In der View — Script mit Fallback:
<script
  src="https://cdn.example.com/lib.min.js"
  asp-fallback-src="~/js/lib.min.js"
  asp-fallback-test="window.myLib"
  integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6..."
  crossorigin="anonymous"></script>

// Stylesheet mit Fallback:
<link
  rel="stylesheet"
  href="https://cdn.example.com/bootstrap.min.css"
  asp-fallback-href="~/css/bootstrap.min.css"
  asp-fallback-test-class="sr-only"
  asp-fallback-test-property="position"
  asp-fallback-test-value="absolute"
  integrity="sha384-..."
  crossorigin="anonymous">

# PowerShell — SRI-Konfiguration verifizieren

# Methode 1: HTML-Quelltext prüfen
$response = Invoke-WebRequest -Uri "https://ihre-domain.de"
$hasIntegrity = $response.Content -match 'integrity="sha'
Write-Host "SRI-Attribute vorhanden: $hasIntegrity"

# Methode 2: Einzelnen Hash verifizieren
$url = "https://cdn.example.com/lib.min.js"
$expected = "sha384-oqVuAfXRKap7fdgcCY5..."
$content = (Invoke-WebRequest -Uri $url).Content
$bytes = [System.Text.Encoding]::UTF8.GetBytes($content)
$actual = "sha384-$([Convert]::ToBase64String(
  [System.Security.Cryptography.SHA384]::Create()
    .ComputeHash($bytes)))"

if ($expected -eq $actual) {
  Write-Host "Hash korrekt" -ForegroundColor Green
} else {
  Write-Host "Hash stimmt nicht!" -ForegroundColor Red
  Write-Host "  Erwartet: $expected"
  Write-Host "  Aktuell:  $actual"
}