security/sri-cdn

Why

A script from a CDN runs with the full rights of your page. If the CDN or the package is compromised, every site that loads the file runs the attacker's code. With an integrity hash, the browser refuses a file that changed.

Fix

Add integrity="sha384-…" (the hash the CDN or openssl dgst -sha384 -binary file | openssl base64 -A gives) and crossorigin="anonymous". Better: install the package and let the build bundle it, so it is served from your origin. URLs without a fixed version (tag managers, latest) cannot use SRI; keep them to a minimum.

Examples

<!-- bad -->
<script src="https://code.jquery.com/jquery-3.7.1.min.js"></script>
<!-- good -->
<script src="https://code.jquery.com/jquery-3.7.1.min.js" integrity="sha384-…" crossorigin="anonymous"></script>

Sources

• MDN, Subresource Integrity
• W3C, Subresource Integrity

Read it in the terminal

npx github:dawidolko/frontend-skills explain security/sri-cdn