.NET Framework 4.7.2中如何自动生成SRI Hash

一、核心SRI Hash生成逻辑 #

SRI的生成逻辑本质是对资源内容计算哈希并转成特定格式，.NET Framework没有现成工具类，但可以自行实现，支持远程资源和本地文件两种场景：

using System;
using System.IO;
using System.Net.Http;
using System.Security.Cryptography;
using System.Text;

public static class SriHashGenerator
{
    public enum HashAlgorithmType
    {
        Sha256,
        Sha384,
        Sha512
    }

    // 从远程CDN资源生成SRI Hash
    public static async System.Threading.Tasks.Task<string> GenerateFromUrl(string resourceUrl, HashAlgorithmType algorithm = HashAlgorithmType.Sha256)
    {
        using (var httpClient = new HttpClient())
        {
            var resourceBytes = await httpClient.GetByteArrayAsync(resourceUrl);
            return GenerateFromBytes(resourceBytes, algorithm);
        }
    }

    // 从本地静态文件生成SRI Hash
    public static string GenerateFromFile(string filePath, HashAlgorithmType algorithm = HashAlgorithmType.Sha256)
    {
        var fileBytes = File.ReadAllBytes(filePath);
        return GenerateFromBytes(fileBytes, algorithm);
    }

    // 核心哈希计算逻辑
    private static string GenerateFromBytes(byte[] data, HashAlgorithmType algorithm)
    {
        HashAlgorithm hashAlgorithm = algorithm switch
        {
            HashAlgorithmType.Sha384 => SHA384.Create(),
            HashAlgorithmType.Sha512 => SHA512.Create(),
            _ => SHA256.Create()
        };

        var hashBytes = hashAlgorithm.ComputeHash(data);
        var base64Hash = Convert.ToBase64String(hashBytes);
        return $"sha{(int)algorithm}-{base64Hash}";
    }
}

二、自动应用到HTML的几种方案 #

1. Razor视图直接调用（ASP.NET MVC场景） #

在cshtml视图中直接生成并插入SRI属性，建议搭配缓存避免重复计算：

@{
    // 可将计算结果存入缓存，比如MemoryCache，避免每次请求都下载资源
    var sriHash = await SriHashGenerator.GenerateFromUrl("https://cdn.example.com/js/library.js");
}
<script src="https://cdn.example.com/js/library.js" integrity="@sriHash" crossorigin="anonymous"></script>

2. 预生成Hash存入配置文件 #

写一个控制台工具提前计算所有第三方资源的SRI Hash，存入Web.config：

<appSettings>
  <add key="LibraryJsSri" value="sha256-abcdefghijklmnopqrstuvwxyz1234567890="/>
</appSettings>

视图中直接读取配置：

<script src="https://cdn.example.com/js/library.js" integrity="@System.Configuration.ConfigurationManager.AppSettings["LibraryJsSri"]" crossorigin="anonymous"></script>

3. 封装HTML Helper简化调用 #

自定义HTML Helper方法，封装生成和标签渲染逻辑：

using System.Web.Mvc;

public static class SriHtmlHelpers
{
    public static MvcHtmlString SriScript(this HtmlHelper helper, string src, SriHashGenerator.HashAlgorithmType algorithm = SriHashGenerator.HashAlgorithmType.Sha256)
    {
        // 加入缓存逻辑，示例用内存缓存
        var cacheKey = $"SRI_{src}_{algorithm}";
        var sriHash = System.Web.HttpContext.Current.Cache[cacheKey] as string;
        
        if (string.IsNullOrEmpty(sriHash))
        {
            sriHash = SriHashGenerator.GenerateFromUrl(src, algorithm).Result;
            System.Web.HttpContext.Current.Cache.Insert(cacheKey, sriHash, null, DateTime.Now.AddDays(7), TimeSpan.Zero);
        }

        var tagBuilder = new TagBuilder("script");
        tagBuilder.MergeAttribute("src", src);
        tagBuilder.MergeAttribute("integrity", sriHash);
        tagBuilder.MergeAttribute("crossorigin", "anonymous");
        return MvcHtmlString.Create(tagBuilder.ToString(TagRenderMode.Normal));
    }
}

视图中直接使用：

@Html.SriScript("https://cdn.example.com/js/library.js")

三、关键注意事项 #

• 必须搭配crossorigin="anonymous"属性，否则浏览器会忽略SRI校验
• 缓存生成的Hash能大幅提升性能，避免重复下载资源和计算
• 第三方资源更新后，必须重新生成Hash，否则浏览器会拒绝加载资源

内容的提问来源于stack exchange，提问作者muthupandi krishnasampy