If you load external scripts from a CDN (analytics, polyfills, widgets) without Subresource Integrity, you are extending your attack surface to that third-party provider's infrastructure.
If that CDN is compromised, attackers can replace the file with malicious JavaScript that runs with full origin privileges in your users' browsers.
Subresource Integrity fixes this with a simple attribute:
<script src="https://cdn.example.com/lib.js" integrity="sha384-..." crossorigin="anonymous"></script>
The browser calculates the SHA-384 hash of the downloaded file before executing it. If a single byte differs from the integrity hash, execution is blocked immediately.
It takes 10 seconds to generate an SRI tag for your static assets, but it protects against entire classes of supply chain attacks.
Generate SRI hashes locally in your browser:
https://utilifi.vercel.app/tools/security/sri-hash-generator
Top comments (0)