Web Security · Senior · Question 53 of 75
A script from a CDN is included with <script src="https://cdn.example/lib@3.2.1.js">. What does adding integrity="sha384-..." protect against?
- 1The file being cached for too long
- ✓Correct answer: The browser refuses to run the file if its content changes, for example if the CDN is compromised
- 3The script being blocked by CSP
Explanation
Subresource Integrity works for versioned, immutable URLs. It requires CORS (crossorigin) for cross-origin scripts.