Subresource Integrity
SRI attaches an integrity attribute containing the resource hash to tags referencing external script/style; the browser executes them only if the hash matches.
Purpose
To prevent tampered CDN-hosted resources from injecting malicious code, ensuring third-party resource integrity.
Mechanism
<script src="cdn.js" integrity="sha384-abc...">: after fetching the resource, the browser computes its hash and compares it with integrity; on mismatch it refuses to execute and reports an error. Hashes use SHA-256/384/512.
Use cases
- CDN resource protection
- Third-party script security
- Supply chain defense