Browser & Web Performance · Middle · Question 57 of 75

What does the `integrity` attribute (Subresource Integrity) protect against?

<script src="https://cdn.example.com/lib.js"
  integrity="sha384-..." crossorigin="anonymous"></script>

1XSS in your own inline scripts
2Slow CDN responses
✓Correct answer: A compromised CDN serving a modified file: the browser refuses to run it if the hash doesn't match

Explanation

The hash pins the exact file contents. It's mainly useful for versioned third-party files that never change.

Further reading

MDN: Subresource Integrity ↗

Test yourself

Take the Browser & Web Performance · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.