Safety
CSP require-sri-for vs Integrity-Policy for CDN Scripts
February 22, 2023
CSP require-sri-for vs Integrity-Policy for CDN scripts is two ways to demand Subresource Integrity — one of them is a CSP leftover. require-sri-for was a Content-Security-Policy directive that asked supporting browsers to require integrity on script and/or style. It is deprecated and poorly supported. Integrity-Policy (and Integrity-Policy-Report-Only) is the dedicated header that tells supporting browsers that specified destinations — typically script — must include integrity. Neither header is the hash. The pin is still integrity= on the tag. RoastMyOpsec reads public HTML for cross-origin scripts without integrity. It does not score require-sri-for or Integrity-Policy, does not recompute hashes, and does not attack the CDN.
The practical difference
SRI is per resource. require-sri-for tried to make that a CSP floor and lost the standards race. Integrity-Policy is the floor that browsers are actually shipping. CSP script-src hashes and nonces are a different allowlist — they name content or a nonce, not a CDN file hash.
Report-Only Integrity-Policy is telemetry. A require-sri-for line in an old CSP copy-paste is not a lock.
How to choose a rollout
First-party bundles: serve from your origin so SRI is optional. Third-party CDNs you must keep: add integrity on every tag, then Integrity-Policy-Report-Only, then enforce when the report bucket is quiet. Do not add require-sri-for to a new policy. Do not enforce Integrity-Policy while a tag manager injects unsigned scripts.
| Control | What it demands | Status | Takeaway |
|---|---|---|---|
| integrity= on the tag | That one URL's bytes | Widely deployed | The actual pin |
| Integrity-Policy | That destination must have a pin | Current header | See Integrity-Policy vs SRI |
| require-sri-for | Same idea inside CSP | Deprecated | Do not ship on new sites |
| CSP nonce/hash | Allowed script content | Widely deployed | Complement; not a CDN hash |
When require-sri-for still appears
It appears in old CSP generators and cargo-cult headers. Integrity-Policy plus real hashes still wins. Missing both headers is not a roast F if tags already have integrity. Pair with unpinned CDN scripts if the tags do not.
What the roast can prove
Cross-origin scripts without integrity can surface. Missing Integrity-Policy and missing require-sri-for are not standalone findings. Confirm the headers yourself. Pair with CSP nonces vs hashes if you also lock inline script.
Common mistakes
The first mistake is adding require-sri-for because a 2017 blog still lists it.
The second mistake is Integrity-Policy enforce while GTM still injects scripts.
The third mistake is treating either header as a replacement for integrity= on the tag.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Should new sites set require-sri-for?
- No. Use SRI on tags you must load from a CDN, then Integrity-Policy when those tags are complete.
- Does Integrity-Policy replace CSP?
- No. It only demands integrity attributes. script-src, object-src, and the rest still do their jobs.
- Does RoastMyOpsec score require-sri-for?
- No. It looks for missing integrity on cross-origin scripts in public HTML. Neither require-sri-for nor Integrity-Policy is a standalone F.