Glossary
SECURITY HEADERS

SRI

Subresource Integrity — an HTML attribute containing a cryptographic hash that browsers verify before executing a fetched script or stylesheet. Blocks CDN tampering.

SRI (Subresource Integrity, W3C spec) is a way to tell the browser: “load this external script, but only run it if its content hashes to this exact value.” SRI is the defence against a compromised CDN silently swapping malicious code into your <script src=".../jquery.min.js">.

HTML Format

<script src="https://cdn.example.com/lib.js"
        integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC"
        crossorigin="anonymous"></script>

How It Works

  • Browser fetches the resource
  • Hashes the response body using the algorithm named in the integrity attribute (sha256, sha384, or sha512)
  • Compares the hash to the value in the attribute
  • If they don’t match, the script is discarded and never executed

Why It Matters

CDN compromises are a real threat: attackers have targeted popular JS libraries by compromising the CDN account, injecting a small skimmer into an otherwise legitimate file. Every consumer of that file gets the skimmer. SRI turns your bundler’s build-time hash into a runtime enforcement — the browser refuses to run tampered code.

Common Miss

  • Loading libraries from a CDN without SRI — inherit the CDN’s security posture, whatever it is
  • Missing crossorigin="anonymous" — the integrity check requires opaque responses to be usable

Check your integrity coverage with the security headers checker.

Check the SHA-256 glossary entry, the CSP glossary entry, and read the HTTP security headers explainer.

← All terms Learning hub →