topic
Verified 2026-09-18Subresource Integrity (SRI)
SRI lets a browser verify that a fetched script or stylesheet matches an expected cryptographic hash.
Use integrity attributes with crossorigin where required, pin exact content, and update hashes deliberately. SRI complements CSP; it does not sanitize HTML or secure arbitrary API responses.
httpsecurityintegritybrowser
Reference (http)
<script src="/app.js" integrity="sha384-BASE64_HASH" crossorigin="anonymous"></script>
Use integrity attributes with crossorigin where required, pin exact content, and update hashes deliberately. SRI complements CSP; it does not sanitize HTML or secure arbitrary API responses.
Common mistakes
- Using a hash for mutable content or assuming SRI covers resources without integrity metadata.