SRI

Subresource Integrity Pins External Assets to Expected Bytes

Subresource Integrity Pins External Assets to Expected Bytes A web page can keep all of its application code under careful review and still execute JavaScript delivered from infrastructure outside its control. Analytics libraries, UI frameworks, payment components, and other dependencies are often fetched from a content delivery network. If that remote response changes, the browser normally has no basis for deciding whether the new bytes are an approved release or an unexpected substitution.