Subresource Integrity or SRI is a W3C recommendation to provide a method to protect website delivery. Specifically, it validates assets served by a third party, such as a content delivery network (CDN). This ensures these assets have not been compromised for hostile purposes.
To use SRI, a website author wishing to include a resource from a third party can specify a cryptographic hash of the resource in addition to the location of the resource. Browsers fetching the resource can then compare the hash provided by the website author with the hash computed from the resource. If the hashes don't match, the resource is discarded.[1]
A sample script element with integrity and crossorigin attribute used by the SRI:
<script src="https://cdn.example.com/app.js"
integrity="sha384-+/M6kredJcxdsqkczBUjMLvqyHb1K/JThDXWsBVxMEeZHEaMKEOEct339VItX1zB"
crossorigin="anonymous"></script>
YouTube Encyclopedic
-
1/3Views:68512 622340
-
JavaScriptLA @ MaxCDN: Web Application Security with Subresource Integrity
-
14. SSL and HTTPS
-
Security and Privacy on the Web (Linuxfest Northwest 2016)
Transcription
References
- ^ "Subresource Integrity". Mozilla Developer Network. Retrieved 14 April 2016.
External links
This page was last edited on 1 August 2023, at 14:28