What is the purpose of the integrity attribute in HTML? [duplicate]

Question

I was on bootstrap's site, and I recently noticed that their CDN links contained an integrity attribute with an SHA-384 key.

<script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/bootstrap.min.js" integrity="sha384-0mSbJDEHialfmuBBQP6A4Qrprq5OVfW37PRR3j5ELqxss1yVqOtnepnHVP9aJ7xS" crossorigin="anonymous"></script>

I assume that is meant to be a way to verify the script source, but moreso I was wondering how it's used and if this is part of any spec?

Furthermore, does this only work with script src's or can it work with any non-same-origin source?

Gabriello

Answer 1

check this :

https://developer.mozilla.org/en/docs/Web/HTML/Element/script

Using Content Delivery Networks (CDNs) to host files such as scripts and stylesheets that are shared among multiple sites can improve site performance and conserve bandwidth. However, using CDNs also comes with a risk, in that if an attacker gains control of a CDN, the attacker can inject arbitrary malicious content into files on the CDN (or replace the files completely) and thus can also potentially attack all sites that fetch files from that CDN.

The Subresource Integrity feature enables you to mitigate the risk of attacks such as this, by ensuring that the files your Web application or Web document fetches (from a CDN or anywhere) have been delivered without a third-party having injected any additional content into those files — and without any other changes of any kind at all having been made to those files.

Read more here :

https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity

Surfeit

I wonder why almost all CDNs ignore the risk by not providing the hash. – Sightless

@Sightless One of the reasons is serving scripts that get updated by their maintainers to delivers updates/new functionality. But yeah, for all those static versioned scripts SRI hash should be always provided. – Fotina

The hash could be generated: openssl dgst -sha384 -binary FILENAME.js | openssl base64 -A – Catapult