Is there a way to tell a browser downloading a file or page that the content it is downloading should match this checksum made with this formula (e.g. sha-1 or md5)?
I think it would be great to verify file integrity without having to manually verify the file's integrity after download.
If it is possible, how would I implement this in my own server? If not, what is the best alternative?
Digest is the standard header used to convey the checksum of a selected representation of a resource (that is, the payload body).
An example response with digest.
>200 OK
>...
>Digest: sha-256=X48E9qOokqqrvdts8nOJRJN3OWDUoyWxBf7kbu9DBPE=
>
>{"hello": "world"}
Digest may be used both in request and responses.
It's a good practice to validate the data against the digest before processing it.
You can see the related page on mozilla website for an indepth discussion around the payload body in http.
I guess that whole HTTP-based Internet is working, because we're using TCP protocol
No, the integrity on the web is ensured by TLS. Non-TLS communication should not be trusted. See rfc8446
Source: Roberto Polli's answer to Checksum in HTTP response header - why not?
