Subresource Integrity
A W3C mechanism in which an integrity attribute on a script or stylesheet element carries a cryptographic hash of the expected file, and the browser refuses to use a fetched file that does not match. It protects against a modified copy on a CDN, not against a compromised first-party server.
- Also called
- SRI
- Defined in
- W3C Subresource Integrity
Covered in
Case study: the polyfill.io CDN takeover (2024)
How the sale of the polyfill.io domain and project in February 2024 turned a script tag on more than 100,000 websites into a channel for malicious redirects by June, why Subresource Integrity could not have protected it, and the controls that would have.
Map PCI DSS Requirement 6 to engineering practice and evidence
Turn PCI DSS v4.0.1 Requirement 6 into engineering work: secure development, review, patching, web-attack protection, payment-page script control and change management, with the records an assessor samples and the parts that became mandatory on 31 March 2025.