v138 · security

Integrity Policy for scripts

Subresource-Integrity (SRI) enables developers to make sure the assets they intend to load are indeed the assets they are loading. But there's no current way for developers to be sure that all of their scripts are validated using SRI. The Integrity-Policy header gives developers the ability to assert that every resource of a given type needs to be integri

concepts

  1. Integrity Policy

    A new CSP-cousin header that requires integrity= on certain resource types. Forces SRI hygiene across the whole site without per-tag attribute hunts.

  2. Violation reporter

    The recommended rollout workflow. Toggle between off, report-only and enforce modes, inject scripts with and without integrity, watch the reporter feed and per-mode counts.

  3. Header Builder

    Build the Integrity-Policy header interactively. Pick mode, blocked destinations, and reporting endpoint — the header value updates live alongside a per-script preview of what would be blocked, reported, or allowed.

  4. SRI migration assistant

    Paste page HTML, detect every <script> and <link> tag missing an integrity attribute, generate a per-file hash, and export patched markup. Simulates the report-only → fix → enforce roll-out workflow for Integrity-Policy.

why it shipped

The ability to assert that all resources of a certain destination were loaded with guaranteed integrity can help developers be sure that no asset is bypassing such protections. That can help them be sure their PCIv4 compliance [1] remains intact.

references