HTML <script> integrity attribute
Definition and Usage
integrity The attribute allows the browser to check the obtained script to ensure that the code is not loaded when the source code is tampered with.
Subresource Integrity (SRI) is a W3C specification that allows web developers to ensure that resources hosted on third-party servers have not been modified. It is recommended to use SRI!
When using SRI, the web page saves the hash value, and the server saves the file (in this case, the .js file). The browser downloads the file, then checks it to ensure it matches integrity The hash value in the attribute matches. If it matches, the file will be used; if not, the file will be blocked.
You can use an online SRI hash generator to generate integrity hashes: SRI Hash Generator.
Example
Use both integrity and crossorigin attributes to link to CDN:
<script src="https://code.jquery.com/jquery-3.3.1.slim.min.js" integrity="sha384-q8i/X+965DzO0rT7abK41JStQIAqVgRVzpbzo5smXKp4YfRvH+8abtTE1Pi6jizo" crossorigin="anonymous"> </script>
Syntax
<script integrity="filehash">
Attribute Value
| Value | Description |
|---|---|
| filehash | File hash of external script files. |
Browser Support
The numbers in the table indicate the first browser version to fully support this attribute.
| Chrome | Edge | Firefox | Safari | Opera |
|---|---|---|---|---|
| Chrome | Edge | Firefox | Safari | Opera |
| 45.0 | 17.0 | 43.0 | 13.0 | 66.0 |
