DevOps & Development Experts
From CI/CD pipelines to custom applications, our team builds secure solutions that scale.
What Is Subresource Integrity (SRI)
Subresource Integrity (SRI) is a web security feature that allows browsers to verify that files fetched from CDNs and third-party servers have not been tampered with. By adding a cryptographic hash to <script> and <link> tags, SRI ensures that the browser only executes resources that match the expected content. If a CDN is compromised and serves malicious code, SRI-protected pages will refuse to load the altered resource.
Supply chain attacks targeting CDN-hosted JavaScript libraries are a growing threat. The 2018 event-stream incident, the 2021 ua-parser-js compromise, and numerous attacks on npm packages demonstrate that third-party code can be weaponized. SRI is the browser-native defense against these attacks—no additional libraries or services required.
How SRI Works
SRI uses cryptographic hash functions to create a fingerprint of the expected file contents:
- Generate hash: Compute the SHA-256, SHA-384, or SHA-512 hash of the resource file
- Add integrity attribute: Include the hash in the HTML tag's
integrityattribute - Browser verifies: When the browser downloads the resource, it computes its hash and compares it to the declared value
- Block on mismatch: If the hashes don't match, the browser refuses to execute the resource
Example:
<script src="https://cdn.example.com/lib.js"
integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8w"
crossorigin="anonymous"></script>
| Hash Algorithm | Output Length | Recommendation |
|---|---|---|
| SHA-256 | 256 bits (64 hex chars) | Minimum acceptable |
| SHA-384 | 384 bits (96 hex chars) | Recommended (best balance) |
| SHA-512 | 512 bits (128 hex chars) | Maximum security |
Multiple hashes: You can include multiple hashes for forward compatibility when updating resources:
integrity="sha384-abc123... sha384-def456..."
The crossorigin="anonymous" attribute is required for SRI on cross-origin resources; without it, the browser cannot verify the hash.
Common Use Cases
- CDN-hosted libraries: Protect jQuery, Bootstrap, React, and other libraries loaded from public CDNs
- Third-party scripts: Verify analytics, chat widgets, and advertising scripts haven't been modified
- Compliance requirements: PCI-DSS 4.0 requires integrity verification for payment page scripts
- Supply chain security: Defend against compromised CDN infrastructure or npm package hijacking
- Build pipeline verification: Generate SRI hashes during CI/CD and embed them in production HTML
Best Practices
- Use SHA-384 as the minimum — SHA-256 is acceptable but SHA-384 is the recommended default for SRI hashes
- Always include crossorigin="anonymous" — Required for cross-origin resources; without it, SRI verification silently fails
- Regenerate hashes when updating libraries — Every version change produces a different hash; automate this in your build process
- Use SRI for all CDN resources — Apply integrity attributes to every
<script>and<link rel="stylesheet">loaded from third-party origins - Combine with Content Security Policy — Use CSP's
require-sri-fordirective to mandate SRI for all scripts and styles on your pages
References & Citations
- MDN Web Docs. (2024). Subresource Integrity. Retrieved from https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity (accessed January 2025)
- W3C. (2016). Subresource Integrity Specification. Retrieved from https://www.w3.org/TR/SRI/ (accessed January 2025)
Note: These citations are provided for informational and educational purposes. Always verify information with the original sources and consult with qualified professionals for specific advice related to your situation.
Key Security Terms
Understand the essential concepts behind this tool
Frequently Asked Questions
Common questions about the SRI Hash Generator
Subresource Integrity (SRI) ensures external resources (CDN JS/CSS) have not been tampered with. Browser verifies file hash matches integrity attribute before executing. Example: script with src attribute pointing to https://cdn.example.com/lib.js with integrity sha384-abc123 and crossorigin anonymous. If file modified (CDN compromise, MITM attack), hash will not match and browser blocks execution. Benefits: prevent CDN compromise, detect file modifications, supply chain security, compliance requirements (PCI DSS). Required for: external resources from CDN, third-party libraries, cross-origin files. W3C standard, supported by all modern browsers. This tool generates SRI hashes for any JS/CSS file instantly.