Is there a way to tell a browser downloading a file or page that the content it is downloading should match this checksum made with this formula (e.g. sha-1 or md5)?

I think it would be great to verify file integrity without having to manually verify the file's integrity after download.

If it is possible, how would I implement this in my own server? If not, what is the best alternative?


Digest is the standard header used to convey the checksum of a selected representation of a resource (that is, the payload body).

An example response with digest.

>200 OK
>Digest: sha-256=X48E9qOokqqrvdts8nOJRJN3OWDUoyWxBf7kbu9DBPE=
>{"hello": "world"}

Digest may be used both in request and responses. It's a good practice to validate the data against the digest before processing it.

You can see the related page on mozilla website for an indepth discussion around the payload body in http.

I guess that whole HTTP-based Internet is working, because we're using TCP protocol

No, the integrity on the web is ensured by TLS. Non-TLS communication should not be trusted. See rfc8446

Source: Roberto Polli's answer to Checksum in HTTP response header - why not?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.