Add Subresource Integrity to third-party scripts
Why it matters
If a CDN or vendor serving your scripts is compromised, the altered file runs on your pages with full access to them. An integrity hash makes the browser refuse any file that differs from the one you approved.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- Stage 1: pick the third-party scripts and stylesheets that load from versioned URLs (a library at a fixed version on a public CDN). Compute each hash with curl -s URL | openssl dgst -sha384 -binary | openssl base64 -A, or copy it from the CDN's page.
- Stage 2: add integrity="sha384-..." and crossorigin="anonymous" to each tag and check the developer console shows no integrity errors. The file must be served with CORS headers, which public CDNs do.
- Do not add integrity to scripts the vendor changes in place (analytics, tag managers, payment SDKs); they would break on the next update. Self-host those if you need the guarantee, or accept the finding.
html
<script src="https://cdn.jsdelivr.net/npm/package@1.2.3/dist/package.min.js" integrity="sha384-PASTE_THE_HASH_HERE" crossorigin="anonymous"></script>
Related
Scan your domain to see whether this applies to you.