demo · v138

Header Builder

Build the Integrity-Policy HTTP header interactively. Pick enforcement mode (enforce vs report), target resource types, and blocked destinations — the header value updates live and you can see exactly what it blocks, what it reports, and what it allows.

Enforcement Mode
Scripts without a valid integrity attribute are blocked.
Violations are reported to the Reporting API endpoint but scripts still load.
Blocked Destinations
Which fetch destinations require integrity checking.
Reporting Endpoint
When enabled, violation reports are sent to the default reporting endpoint. Pair with a Reporting-Endpoints header on your server.
Generated Header
Integrity-Policy: enforce script

Effect on script loading

# Server response header (enforce mode)
Integrity-Policy: enforce script

# HTML: SRI hash required — loads fine
<script src="/app.js"
  integrity="sha384-…"
  crossorigin="anonymous"></script>

# HTML: no integrity — blocked by policy
<script src="/analytics.js"></script>

see also