Checksum in HTTP response header - why not?
<p>I'd like to know some kind of file checksum (like SHA-256 hash, or anything else) when I start downloading file from HTTP server. It could be transferred as one of HTTP response headers.</p>

<p>HTTP <code>etag</code> is something similar, but it's used only for invalidating browser cache and, from what I've noticed, every site is calculating it in different way and it doesn't look like any hash I know. </p>

<p>Some software download sites provide various file checksums as separate files to download (for example, latest Ubuntu 16.04 SHA1 hashes: <a href="http://releases.ubuntu.com/16.04/SHA1SUMS" rel="noreferrer">http://releases.ubuntu.com/16.04/SHA1SUMS</a>). Won't it be easier to just include them in HTTP response header and force browser to calculate it when download ends (and do not force user to do it manually).</p>

<p>I guess that whole HTTP-based Internet is working, because we're using TCP protocol, which is reliable and ensures received bytes are exactly same as one send by the server. But if TCP is so "cool", why do we check file hashes manually (see abouve Ubuntu example)? And lot of thing can go wrong during file download (client/server disk corruption, file modification on server side etc.). And if I'm right, everything could be fixed simply by passing file hash at download start.</p>