snag.page

Every check · Page contents

Integrity on CDN files

content/sri

What it checks

Scripts and stylesheets from public CDNs without an integrity hash.

Why it matters

If the CDN served a changed file, browsers would run it; a hash makes them refuse it.

How to fix it

  1. Add an integrity attribute with each file's hash, and crossorigin="anonymous"; the CDN's site gives both.
  2. Or serve the files from your own domain.
HTML
<script src="https://cdn.example/lib.min.js"
  integrity="sha384-…" crossorigin="anonymous"></script>

Check a site for this and everything else: snag.page. More on page contents: Mixed content Forms over HTTPS Libraries with known flaws Generator tag Script hosts