News
Integrity-Policy vs Subresource Integrity for CDN Scripts
June 21, 2024
Integrity-Policy vs Subresource Integrity for CDN scripts is a header that demands hashes versus the hashes themselves. SRI is integrity= on a <script> or <link>. Integrity-Policy (and Integrity-Policy-Report-Only) tells supporting browsers that specified destinations — typically script — must include integrity, and can report violations. The header does not pin a CDN URL by itself. An integrity attribute without a matching file still fails closed in the browser. Unpinned third-party scripts remain the miss. RoastMyOpsec reads public HTML for cross-origin scripts without integrity. It does not score Integrity-Policy, does not recompute hashes, and does not attack the CDN.
The practical difference
SRI is per resource. Forget one tag and that script is unpinned. Integrity-Policy is a floor: supporting browsers can refuse or report scripts that shipped without integrity. CSP hashes and nonces are a different allowlist — they name content or a nonce, not a CDN file hash. See CSP nonces vs hashes.
Report-Only Integrity-Policy is telemetry, like CSP-Report-Only. Do not treat reports as a lock.
How to choose a rollout
First-party bundles: prefer serving from your origin so SRI is optional. Third-party CDNs you must keep: add integrity on every tag, then Integrity-Policy-Report-Only, then enforce when the report bucket is quiet. Do not enforce while a tag manager injects unsigned scripts.
| Control | What it pins | Browser support note | Takeaway |
|---|---|---|---|
| integrity= on the tag | That one URL's bytes | Widely deployed | The actual pin |
| Integrity-Policy | That destination must have a pin | Newer; not universal | Floor, not a hash |
| CSP script-src hash/nonce | Inline or allowed sources | Widely deployed | Complement; see nonce vs hash |
| Unpinned CDN src | Nothing | Works until the file changes | The miss the roast looks for |
What the roast can prove
Cross-origin scripts without integrity can surface as findings. Missing Integrity-Policy is not a finding. A present Integrity-Policy with still-unpinned tags is a policy the browser may enforce later — fix the tags. Pair with GitHub Actions if the hash is generated in CI.
Common mistakes
The first mistake is Integrity-Policy enforce while GTM still injects scripts.
The second mistake is copying an integrity hash from a blog post and never regenerating it in CI.
The third mistake is treating Integrity-Policy as a replacement for CSP.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Does Integrity-Policy replace SRI attributes?
- No. It requires them (in supporting browsers). The hash still lives on the tag.
- Should every marketing site set Integrity-Policy?
- After every third-party script you keep has integrity. Report-Only first. Missing the header is not a roast F.
- Does RoastMyOpsec score Integrity-Policy?
- No. It looks for missing integrity on cross-origin scripts in public HTML.