Use subresource integrity (
sri warns about requesting scripts or stylesheets without using
Why is this important?
A common practice in modern web development is to use third party resources from CDNs or different services (analytics, ads, etc.). However, doing so can increase the attack surface of your web site/app.
While there are techniques to verify the agent is talking with the right server (TLS, HSTS, etc.), an attacker (or administrator) with access to the server can manipulate the content with impunity.
If you want to load a crypto miner on 1,000+ websites you don't attack 1,000+ websites, you attack the 1 website that they all load content from. (Scott Helme)
Subresource integrity is a standard that mitigates this by ensuring that an exact representation of a resource, and only that representation, loads and executes.
What does the hint check?
This hint checks that a website correctly uses SRI, more specifically:
- All the downloaded resources by an
<link rel="stylesheet">have an
integrityattribute needs to be valid. I.e.: it should contain something in the form of
HASHis the hashed value of the downloaded body's response using the previously specified algorithm (
- The minimum cryptographic hash function used is
sha384. If multiple ones are provided, the highest one will be used to determine if the baseline is met.
- When using a cross-origin resource (e.g.: using a script hosted in
a third party CDN), the
<link>tag needs to have a valid
- The resource is served on a secure context (i.e.: HTTPS) to guarantee the HTML and resource haven't been tampered during the delivery.
- The hash from the
integrityattribute needs to be the same as the one calculated using the response's body.
- If multiple hashes are provided, at least one needs to be valid.
Examples that trigger the hint
Cross-origin resource with no
Cross-origin resource with invalid
Cross-origin resource loaded over
Same-origin resource with no
originCriteria set to
Examples that pass the hint
Cross-origin resource with multiple hashes and
sha384 is one of them:
Cross-origin resource with valid
Can the hint be configured?
Yes, you can define the baseline algorithm and the origin of the resources to analyze.
By default the baseline algorithm is
sha384 but you can
change it to
sha512 by specifying that in the
The above will validate that the
integrity of all scripts and
By default, this hint will analyze only resources with a different origin.
To change this behavior you will have to set the
to one of the following:
all: All resources will be analyzed
crossOrigin: Only cross-origin resources will be analyzed
The following will analyze all the resources:
How to use this hint?
This package is installed automatically by webhint:
npm install hint --save-dev
To use it, activate it via the
.hintrc configuration file:
Note: The recommended way of running webhint is as a