Stop 6 of 42 · The Front Door · Subresource Integrity (SRI)

Tamper-evident seals on vendor deliveries

The bank orders supplies from an outside vendor every day and opens whatever arrives. If Mallory breaks into the vendor and swaps a parcel, the bank happily uses it. A tamper-evident seal lets the bank check each parcel against a fingerprint it wrote down earlier.

The Front DoorSources checked 25 Oct 2026

Watch it happen

Play it as

The vendor’s parcel is swapped by Mallory. The bank’s page opens it without checking and runs it for every visitor.

Arrival

Alice walks in. The bank’s page loads a helper script from an outside vendor (a CDN) with a tag like <script src="https://cdn…/lib.js">.

Outside vendor to Script parcel: lib.js.
1 / 5

In bank terms and app terms

In the bankIn your app
Outside vendorA CDN or third-party host serving scripts and styles
Fingerprint written on the order slipThe integrity="sha384-…" attribute on the tag
Checking the seal on arrivalThe browser comparing the file’s hash with the attribute
Swapped parcelA script changed at the CDN or in transit

Are you exposed?

You might be exposed if…
  • Your HTML has <script src="https://…"> or <link rel="stylesheet" href="https://…"> pointing to another domain without an integrity attribute.
  • You load libraries from a CDN using a “latest” URL with no pinned version.
  • Your checkout, login or admin pages load third-party scripts.
What to do about it
  1. Add integrity="sha384-…" and crossorigin="anonymous" to every third-party script and stylesheet tag (the host must allow cross-origin requests, which public CDNs do). Tools like srihash.org can generate the value.
  2. Pin an exact version in the URL so the file doesn’t change underneath the fingerprint.
  3. Better still, install the library with npm and serve it from your own domain. Remove third-party scripts you don’t need.

Track these in your to-do list →

Ask your AI tool to fix it

Paste this into Cursor, Claude, Lovable, Bolt or whatever you build with.

Prompt
Find every script and stylesheet loaded from another domain in this project. For each one, pin an exact version and add an integrity attribute (sha384 hash) plus crossorigin="anonymous". Where possible, instead install the package with npm and bundle it from our own domain. Tell me which third-party scripts can be removed and which cannot be given an integrity hash (for example, ones that change per request).

Where this comes from

The facts, figures and fixes on this page were checked against these sources on 25 Oct 2026. They are linked so you can check for yourself.

  • Subresource IntegrityMDN Web Docsintegrity sha384 hash; browser refuses a mismatched file; needs crossorigin and CORS; srihash.org
  • Subresource IntegrityW3CSpec for integrity hashes (SHA-256/384/512) and the CORS requirement
  • crossorigin attributeMDN Web Docscrossorigin="anonymous" makes a CORS request without cookies; CDN must allow it

Spot a mistake or something out of date? Report a correction · How these guides are made and checked

Go deeper in isitsecure

The free, open-source scanner checks for most of the problems in these guides.