demo · v138

Integrity-Policy header simulator

Pick a policy, add <script src> URLs with or without an integrity attribute. The simulator shows which would load, which would be blocked, and what payload Reporting-Endpoints would receive — exactly as Chrome 138 evaluates it.

Pure in-page simulation of the spec rules. The header below is not actually sent; Chrome 138 simply applies the same logic when it sees the real header.

policy

add script URL integrity="sha384-..."

src	integrity?	outcome	browser action

(reports will appear here when blocked-or-reported scripts are loaded)

the response header

HTTP/1.1 200 OK
Content-Type: text/html
Integrity-Policy: blocked-destinations=(script), endpoints=(sri-violations)
Reporting-Endpoints: sri-violations="https://example.com/csp-report"

the response header

see also