What is Subresource Integrity?
A W3C security specification enabling web browsers to verify that remote resources (scripts and stylesheets) fetched from third-party CDNs have not been maliciously modified by validating base64 cryptographic hashes.
Cryptographic Hash Verification in HTML Tags
When loading libraries from external CDNs, developers include an `integrity` attribute containing a cryptographic hash prefix (e.g., `integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC"`).
Before executing the fetched script, the browser rendering engine computes the SHA-384 digest of the downloaded payload. If even a single byte differs (indicating CDN tampering or an injected malicious payload), the browser aborts execution immediately.
Defending Against Third-Party Supply Chain Attacks
High-profile cyberattacks routinely target third-party CDN providers to inject credit card skimmers or crypto-miners into thousands of downstream websites simultaneously.
SRI acts as an unyielding cryptographic firewall: even if an attacker compromises the CDN server and alters the hosted script, client browsers reject the modified file because the cryptographic hash no longer matches.
Key Advantages & Impact
- Neutralizes supply chain attacks originating from compromised third-party hosting infrastructure
- Guarantees that production web apps run exclusively verified, bit-exact script versions
- Zero performance penalty: hash verification occurs concurrently during network payload streaming
Common Misconceptions vs Reality
Experience This Technology in DocSwift Tools
Frequently Asked Questions
Which hashing algorithm is recommended for SRI?
W3C recommends SHA-384 or SHA-512 for SRI attributes to ensure long-term collision resistance.