Description
Subresource Integrity (SRI) is a security feature that allows browsers to verify that resources fetched, such as from a content delivery network (CDN), are delivered without unexpected manipulation. It achieves this by enabling you to provide a cryptographic hash that the fetched resource must match.
Recommendation
To enhance security, add a base64-encoded hash of the resource in the value of the integrity attribute of the <script> or <link> element. You can obtain the hash from the resource provider or calculate it yourself. See references for details.
References
Could your website be exposed too?
SmartScanner can check your website for Subresource Integrity is Missing and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry - Vulnerability
- StableLib Ed25519 Signature Malleability via Missing S < L Check - Vulnerability
- Content-Security-Policy Header is Missing - Vulnerability
- Missing or Insecure Cache-Control Header - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated May 13, 2024