demo · v135

Integrity pipeline

Pick a public key and an asset URL. The pipeline walks you through — expected public key on the link tag, response carrying Identity-Digest + Signature, browser verifying the chain. Toggle “CDN tampers with body” to see the verdict flip from OK to FAIL.

Web Crypto: yes

1. request

<link rel="modulepreload" href="/lib/vendor.js" integrity="ed25519-...">

2. response headers

Identity-Digest: sha-256=...
Signature: ed25519-...
Signature-Input: ...

3. browser verifies

verifies signature(Identity-Digest)
against public key in integrity attr
click verify

see also