RoastMyOpsec

Safety

CSP require-sri-for vs Integrity-Policy for CDN Scripts

February 22, 2023

CSP require-sri-for vs Integrity-Policy for CDN scripts is two ways to demand Subresource Integrity — one of them is a CSP leftover. require-sri-for was a Content-Security-Policy directive that asked supporting browsers to require integrity on script and/or style. It is deprecated and poorly supported. Integrity-Policy (and Integrity-Policy-Report-Only) is the dedicated header that tells supporting browsers that specified destinations — typically script — must include integrity. Neither header is the hash. The pin is still integrity= on the tag. RoastMyOpsec reads public HTML for cross-origin scripts without integrity. It does not score require-sri-for or Integrity-Policy, does not recompute hashes, and does not attack the CDN.

The practical difference

SRI is per resource. require-sri-for tried to make that a CSP floor and lost the standards race. Integrity-Policy is the floor that browsers are actually shipping. CSP script-src hashes and nonces are a different allowlist — they name content or a nonce, not a CDN file hash.

Report-Only Integrity-Policy is telemetry. A require-sri-for line in an old CSP copy-paste is not a lock.

How to choose a rollout

First-party bundles: serve from your origin so SRI is optional. Third-party CDNs you must keep: add integrity on every tag, then Integrity-Policy-Report-Only, then enforce when the report bucket is quiet. Do not add require-sri-for to a new policy. Do not enforce Integrity-Policy while a tag manager injects unsigned scripts.

ControlWhat it demandsStatusTakeaway
integrity= on the tagThat one URL's bytesWidely deployedThe actual pin
Integrity-PolicyThat destination must have a pinCurrent headerSee Integrity-Policy vs SRI
require-sri-forSame idea inside CSPDeprecatedDo not ship on new sites
CSP nonce/hashAllowed script contentWidely deployedComplement; not a CDN hash

When require-sri-for still appears

It appears in old CSP generators and cargo-cult headers. Integrity-Policy plus real hashes still wins. Missing both headers is not a roast F if tags already have integrity. Pair with unpinned CDN scripts if the tags do not.

What the roast can prove

Cross-origin scripts without integrity can surface. Missing Integrity-Policy and missing require-sri-for are not standalone findings. Confirm the headers yourself. Pair with CSP nonces vs hashes if you also lock inline script.

Common mistakes

The first mistake is adding require-sri-for because a 2017 blog still lists it.

The second mistake is Integrity-Policy enforce while GTM still injects scripts.

The third mistake is treating either header as a replacement for integrity= on the tag.

Free audit the URL you own

RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.

Free audit now

FAQ

Should new sites set require-sri-for?
No. Use SRI on tags you must load from a CDN, then Integrity-Policy when those tags are complete.
Does Integrity-Policy replace CSP?
No. It only demands integrity attributes. script-src, object-src, and the rest still do their jobs.
Does RoastMyOpsec score require-sri-for?
No. It looks for missing integrity on cross-origin scripts in public HTML. Neither require-sri-for nor Integrity-Policy is a standalone F.

Sources

Related guides