SRI Hash Generator

What SRI protects against

Loading a script from a CDN means executing whatever that host returns, with full access to your page: the DOM, cookies accessible to script, and anything a user types. If the CDN is compromised, or an attacker intercepts the response, they run code as your site. Subresource integrity attaches an expected hash to the tag, and the browser refuses to execute anything that does not match. The Polyfill.io incident, where a widely-used CDN began serving malicious code to hundreds of thousands of sites, is exactly the scenario SRI prevents.

Pin the version, always

SRI hashes a specific file. Pointing at a URL that means latest guarantees the hash will break the moment the file changes, and worse, tempts people to remove the integrity attribute to make the site work again. Always reference an exact version so the content is stable and the hash stays valid.

Crossorigin is required

A cross-origin resource must be fetched with CORS for the browser to read enough of it to verify. Without the crossorigin attribute set to anonymous, the check cannot run and the resource is blocked. Omitting it is the most common reason SRI appears to break a working page.

Choose SHA-384

SHA-256, SHA-384 and SHA-512 are all permitted. SHA-384 is the common recommendation and there is no practical reason to use anything weaker. Multiple hashes may be supplied for the same resource, and the browser accepts the file if any one matches, which is how you roll a version without a moment of breakage.

There is no fallback

If the hash does not match, the resource simply does not load, and a page depending on it breaks completely rather than degrading. That is the correct behaviour for a security control and it means the hash must be right. Generate it from the exact file you will serve, not from a similar one.

Self-hosting is often simpler

SRI mitigates CDN compromise, but hosting the file yourself removes the third party entirely, avoids the extra DNS and TLS handshake, and no longer benefits from cross-site caching, which browsers partitioned years ago for privacy reasons. For most sites the CDN advantage that justified the risk no longer exists.