SRI (Subresource Integrity): Definition, Use Cases, and Examples

SRI (Subresource Integrity) protects against CDN compromise. In <script src="..." integrity="sha384-..."> the integrity attribute contains a hash of the expected content. If the CDN swaps the file (supply-chain attack), the hash mismatches and the browser refuses to execute. Mandatory for all external CDN resources.

Open tool →

Subresource Integrity (SRI) is a security feature that enables browsers to verify that files hosted on third-party servers have not been manipulated. When a web page references an external script or stylesheet, it can include an integrity attribute, which contains a cryptographic hash of the file's expected content. This hash is computed using a secure hashing algorithm like SHA-256, SHA-384, or SHA-512.

When the browser fetches the resource, it computes the hash of the downloaded file and compares it with the hash provided in the integrity attribute. If the hashes do not match, the browser will refuse to execute the file, thereby preventing potential supply-chain attacks where an attacker compromises a Content Delivery Network (CDN) to deliver malicious content.

To implement SRI, you can use the following syntax:

<script src="https://cdn.example.com/library.js" integrity="sha384-abc123..." crossorigin="anonymous"></script>

The crossorigin attribute is also crucial for SRI as it specifies how the browser should handle CORS (Cross-Origin Resource Sharing) requests.

Implementing Subresource Integrity (SRI) effectively requires adherence to several best practices to maximize security:

• Use Strong Hash Algorithms: Opt for SHA-384 or SHA-512 for generating hashes. These algorithms provide better security than SHA-256, which is easier to compromise.
• Regularly Update Hashes: Whenever you update third-party resources, ensure that you regenerate the hash and update the integrity attribute accordingly. This prevents mismatches that could lead to broken functionality.
• Test in Development: Before deploying changes to production, thoroughly test your SRI implementation in a staging environment. This helps identify any potential issues with integrity checks.
• Monitor External Resources: Regularly audit and monitor the external resources you include. If a CDN changes its file without your knowledge, you need to be aware of the potential risks.

By following these best practices, web developers can significantly reduce the risk of supply-chain attacks and ensure that their applications are secure.

To integrate Subresource Integrity (SRI) into your web project, follow these steps:

1. Identify External Resources: List all external scripts and stylesheets your application uses, particularly those served from CDNs.
2. Generate Hashes: Use a command-line tool like openssl to generate the hash for each file. For example:

openssl dgst -sha384 -binary library.js | openssl base64 -A

This command computes the SHA-384 hash of library.js and encodes it in base64 format.

3. Update HTML Files: Insert the generated hash into your HTML files. For example:

<script src="https://cdn.example.com/library.js" integrity="sha384-" crossorigin="anonymous"></script>

4. Test Your Implementation: Open your web application in a browser and check the console for any integrity errors. If the resource is tampered with, the browser should block its execution.

Following these steps will ensure your web application is safeguarded against supply-chain attacks through effective use of SRI.