Subresource Integrity (SRI) Reference
Reference for SRI: hash-based verification of third-party resources to prevent tampering.
SRI Mechanism
SRI adds an integrity attribute to script and link tags containing a hash of the expected resource. The browser computes the hash of the downloaded resource and compares it before execution. If hashes mismatch, the resource is blocked and a CSP violation reported. SRI protects against CDN compromise and in-transit tampering. The hash uses sha256, sha384, or sha512 with base64 encoding. Multiple algorithms can be combined for future-proofing.
- integrity
- Hash attribute
- mismatch
- Block resource
- algorithms
- sha256/384/512
sha384-base64CSP reportbase64 encodedUsage Considerations
SRI only applies to same-origin or CORS-enabled resources (crossorigin attribute needed). The hash must be updated when the resource changes, complicating deployment. SRI does not protect against compromised first-party servers. It complements but does not replace TLS. Tools generate integrity hashes from file contents. SRI is most valuable for third-party libraries from CDNs. Without crossorigin, cross-origin SRI is silently ignored.
- crossorigin
- Required for cross-origin
- updates
- Rehash on change
- CDN
- Primary use case
CORS neededdeployment costthird-party libs