Vulnerabilities
Subresource Integrity vs Unpinned CDN Scripts
January 13, 2026
Subresource Integrity vs unpinned CDN scripts is a supply-chain control, not a speed debate. SRI (the integrity attribute) tells the browser to refuse a script or stylesheet whose hash does not match. Unpinned CDN URLs — especially versionless or jQuery 1.x/2.x leftovers — execute whatever that URL returns today. Self-hosting critical JS is often simpler than hashing a moving vendor file. RoastMyOpsec parses public HTML for cross-origin script tags, missing integrity, and explicit legacy jQuery patterns. It does not download exploit kits or mutate your CDN.
The practical difference
A CDN URL without integrity is a live remote. If the host is compromised, the name is reused, or a 'latest' path moves, your visitors run new code under your origin's pages.
SRI pins a hash. The file can still be served from a CDN for performance, but the browser will not execute a surprise body. If you cannot keep the hash in lockstep with releases, self-host the exact file you tested.
How to choose based on the asset
First-party bundles belong on your origin. Third-party widgets should be the smallest set you can justify, with integrity when the vendor publishes hashes, plus a CSP that names those hosts. Analytics tags that rewrite themselves weekly may not be SRI-friendly — that is a reason to cut them, not to skip the question.
| Pattern | SRI? | Better default | Takeaway |
|---|---|---|---|
| Self-hosted app bundle | Optional | Your origin, hashed filename | You already pin via the build |
| cdn.jsdelivr / unpkg without integrity | Required if you keep the CDN | Self-host or add integrity | Classic unpinned miss |
| Legacy jQuery 1.x / 2.x from a public CDN | Does not fix old bugs | Upgrade or remove | Hashing museum code still leaves known holes |
| Tag manager | Usually no stable hash | Minimize; CSP-shape the rest | SRI cannot save an unbounded loader |
When SRI is not enough
Integrity does not review what the original file does. A hashed tracker still runs tracker code. Pair SRI with CSP script-src and a shorter third-party list.
crossorigin is required on many cross-origin SRI tags so the browser can check the hash. Missing it makes the integrity attribute fail closed or be ignored depending on the browser — confirm in a site you own.
Common mistakes
The first mistake is copying a CDN snippet from 2016 and never pinning it.
The second mistake is hashing a file, then letting the src query string float to a new version.
The third mistake is putting SRI on CSS while leaving the real XSS surface — scripts — unpinned.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Does SRI replace Content-Security-Policy?
- No. SRI pins a file's bytes. CSP limits which origins and, with nonces/hashes, which inline scripts may run. You usually want both.
- Should I self-host or use a CDN with SRI?
- Self-host if the file is critical and small. Use a CDN plus integrity when you need the vendor's edge and they publish stable hashes you can update on purpose.
- How does RoastMyOpsec flag CDN risk?
- It reads public HTML tags for cross-origin scripts without integrity and for explicit legacy jQuery version patterns. No payloads, no supply-chain attacks against the CDN.