Skip to content
Back to Stack Recommender

Subresource Integrity

SRI — cryptographic hash to verify third-party resource integrity.

SecuritySimple

Stack Components

Attributeintegrity

Why

Prevents tampered CDN resources from executing, browser-enforced. Verizon DBIR 2024: 68% of breaches involve human error.

Snyk and Dependabot scan 500k+ npm packages for CVEs, and OWASP Top 10 hasn't changed much — injection and broken auth remain #1 and #2.

When

Use for third-party scripts/styles. Avoid for self-hosted assets.

How

1. Generate hash with openssl 2. Add integrity attribute 3. Add crossorigin 4. Test in browser 5. Add environment configuration — cp .env.example .env && edit values 6. Run tests — npm test or pnpm test to verify setup 7. Deploy — git push to trigger CI/CD or manual deploy

Example

<script src="https://cdn.example.com/lib.js" integrity="sha384-oqVuAfXRKap7fdgcCY5UYk..." crossorigin="anonymous"></script> // Subresource Integrity — usage example import { SubresourceIntegrity } from "sec2-sri"; const result = await subresourceintegrity({ input: "data" }); console.log(result);

Common Problems

  • ⚠Hash mismatch on update — regenerate hash
  • ⚠CORS — add crossorigin attribute
  • ⚠Configuration drift between environments — use infrastructure-as-code (Terraform/Pulumi) to keep dev/staging/prod identical

Best Practices

  • ✓Use sha384 for strong hashing
  • ✓Automate hash generation in build
  • ✓Set up health checks and graceful shutdown — handle SIGTERM to drain in-flight requests before exit

FAQ

What is Subresource Integrity and what projects is it for?

SRI — cryptographic hash to verify third-party resource integrity. It pairs layered technologies for end-to-end type safety and out-of-the-box deploys, fitting everything from MVPs to production SaaS.

How do I spin up a working demo with Subresource Integrity in 10 minutes?

Two steps: (1) Generate hash with openssl; (2) Add integrity attribute. Get the local dev server running, then wire one real data source to verify the end-to-end loop.

What is the most common pitfall with Subresource Integrity and how do I avoid it?

The most common pitfall is: Hash mismatch on update — regenerate hash. Avoid it by adding the matching checklist to your PR template and running type-check + lint + unit tests in CI — three gates before merge.

What are the best practices for Subresource Integrity?

Best practices for Subresource Integrity include: Use sha384 for strong hashing; Automate hash generation in build; Set up health checks and graceful shutdown — handle SIGTERM to drain in-flight requests before exit. The first one — "Use sha384 for strong hashing" — should be set up at project init to avoid costly rework later.

When should I NOT choose Subresource Integrity?

Pick something else in three cases: (1) the team has zero experience with the core framework and the deadline is tight (learning-curve risk); (2) it's a pure content/marketing site (Astro is lighter); (3) you need very high throughput (>10k RPS) or strict-consistency microservices (Go/Rust). Subresource Integrity shines for mid-to-high complexity full-stack and API work — don't over-engineer simple static pages with it.