What happens if the SRI hash does not match?

The browser blocks the resource and reports a violation to the console. The page may break if the resource is essential. This is the desired behavior — it is better to break than to load tampered code. Monitor SRI violations and update hashes when you intentionally update the resource.

Does SRI protect against all CDN attacks?

No. SRI protects against modification of the resource content (tampering, MITM). It does not protect against: the CDN going down (use fallback), the CDN serving a different resource (wrong URL), or the CDN logging your traffic. SRI is one layer of defense — combine with HTTPS, CSP, and trusted CDNs.

Utiliser Subresource Integrity (SRI) pour external resources

SRI ensures external scripts/styles avoir non been tampered avec par verifying leurs hachage. Apprendre en générer et vérifier integrity attributes.

1

SRI adds an integrity attribute to <script> and <link> tags: integrity="sha384-<base64-hash>". The browser computes the hash of the downloaded resource and compares it to the integrity attribute. If they do not match, the resource is blocked. This prevents CDN compromise or MITM attacks from injecting malicious code via external resources.
2

Calculatrice de hash →
Calculer the SHA-384 hash of the external resource (script or CSS file). Base64-encode the hash. The integrity attribute is: integrity="sha384-<base64-hash>". Use SHA-384 (not SHA-256) for SRI — it is the recommended algorithm. The crossorigin attribute is also required for SRI on cross-origin resources.
3

Hash SHA-3 / Keccak →
Alternatively, use SHA-3-256 for SRI. While SHA-384 is the standard, SHA-3 is also supported by modern browsers. Use the strongest available algorithm. The hash must be computed over the exact bytes of the resource — any modification (whitespace, minification) changes the hash.

Questions fréquentes

What happens if the SRI hash does not match?: The browser blocks the resource and reports a violation to the console. The page may break if the resource is essential. This is the desired behavior — it is better to break than to load tampered code. Monitor SRI violations and update hashes when you intentionally update the resource.
Does SRI protect against all CDN attacks?: No. SRI protects against modification of the resource content (tampering, MITM). It does not protect against: the CDN going down (use fallback), the CDN serving a different resource (wrong URL), or the CDN logging your traffic. SRI is one layer of defense — combine with HTTPS, CSP, and trusted CDNs.