Home›Technology›Cybersecurity (continued)›What is Subresource Integrity?
⚡ Technology·2 min·Updated Mar 14, 2026

What is Subresource Integrity?

Subresource Integrity

Quick Answer

It is a security feature that helps ensure that files loaded on a website, like scripts or styles, have not been tampered with. By using Subresource Integrity, web developers can specify a cryptographic hash for these files, allowing browsers to verify their integrity before executing them.

Overview

Subresource Integrity (SRI) is a security mechanism that provides a way for web developers to ensure that the resources they include in their web pages have not been altered. This is particularly important for third-party resources, such as JavaScript libraries or CSS stylesheets, which can be easily modified by attackers if they gain control of the hosting server. By using a cryptographic hash, SRI allows browsers to check that the resource matches the expected value before it is executed, helping to prevent malicious code from running on a user's device. When a developer includes a resource with SRI, they attach a hash value to the resource link. This hash is generated from the original file and acts like a fingerprint. If the file is changed in any way, even slightly, the hash will no longer match, and the browser will refuse to load the altered resource. For example, if a website uses a popular JavaScript library from a CDN (Content Delivery Network), it can use SRI to ensure that the library remains unchanged and safe for users. This feature is crucial in the context of cybersecurity because it adds an extra layer of protection against attacks that exploit vulnerabilities in third-party scripts. By ensuring that only trusted and verified resources are loaded, developers can significantly reduce the risk of cross-site scripting (XSS) attacks and other security issues. As more websites rely on external resources, the importance of using Subresource Integrity continues to grow.

Frequently Asked Questions

Subresource Integrity works by allowing developers to include a cryptographic hash in the HTML link for a resource. When the browser fetches the resource, it calculates the hash of the file and compares it to the provided hash. If they match, the resource is loaded; if not, the browser blocks it.
It is important because it helps protect websites from malicious changes to third-party resources. By verifying that the resources have not been altered, developers can prevent potential attacks that could compromise user security.
Subresource Integrity can be used with scripts and styles that are loaded from external sources. However, it is not applicable to resources that are hosted on the same server as the website, as they can be controlled directly by the developer.