topic
Verified 2026-09-18

Integrity-Policy

Requires integrity metadata for selected browser subresource destinations.

Use Integrity-Policy as defense in depth with Subresource Integrity. It has limited browser availability and can block no-cors resources without integrity metadata.

httpheadersecurityintegritybrowser

Reference (http)

Integrity-Policy: blocked-destinations=(script style)

Use Integrity-Policy as defense in depth with Subresource Integrity. It has limited browser availability and can block no-cors resources without integrity metadata.

Common mistakes

  • Deploying it without checking browser support and third-party script dependencies.

Sources

Permalink: https://merginit.com/reference/http/field-integrity-policy