https://nalar.dev/tags/supply-chain-security/ Recent content in Supply Chain Security on Nalar Hugo en-us Tue, 15 Sep 2026 00:00:00 +0700 https://nalar.dev/subresource-integrity-pins-external-assets-to-expected-bytes/ Tue, 15 Sep 2026 00:00:00 +0700 https://nalar.dev/subresource-integrity-pins-external-assets-to-expected-bytes/ <h1 id="subresource-integrity-pins-external-assets-to-expected-bytes">Subresource Integrity Pins External Assets to Expected Bytes</h1> <p>A web page can keep all of its application code under careful review and still execute JavaScript delivered from infrastructure outside its control. Analytics libraries, UI frameworks, payment components, and other dependencies are often fetched from a content delivery network. If that remote response changes, the browser normally has no basis for deciding whether the new bytes are an approved release or an unexpected substitution.</p> https://nalar.dev/subresource-integrity-pins-browser-dependencies-to-expected-bytes/ Mon, 14 Sep 2026 00:00:00 +0700 https://nalar.dev/subresource-integrity-pins-browser-dependencies-to-expected-bytes/ <h1 id="subresource-integrity-pins-browser-dependencies-to-expected-bytes">Subresource Integrity Pins Browser Dependencies to Expected Bytes</h1> <p>A production page can contain no application-side injection flaw and still execute hostile JavaScript if a trusted external asset changes underneath it. The script URL may be correct, TLS may be valid, and the browser may have reached the intended host. None of those facts establish that the returned file is the exact artifact the site operator approved.</p> <p>Subresource Integrity, commonly shortened to SRI, adds that missing assertion for selected browser-loaded scripts and stylesheets. An <code>integrity</code> attribute carries one or more cryptographic digest values. After fetching the resource, the browser computes the digest of the representation used for the integrity check and refuses to apply or execute it when no supported digest matches.</p>