Subresource Integrity Policy
Requires selected script and style requests to carry integrity metadata, with an optional report-only rollout mode.
Support in current browsers
Checked against the current browser versions recorded in MDN browser data 8.0.7.
| Browser | Minimum | Outcome | Reason |
|---|---|---|---|
| Chrome | 150 | Works | Every required mapped BCD feature is available without a recorded qualification. |
| Edge | 150 | Works | Every required mapped BCD feature is available without a recorded qualification. |
| Firefox | 152 | Works with limits | Every required mapped feature is available, but BCD records one or more qualifications. |
| Safari | 26.5 | Works | Every required mapped BCD feature is available without a recorded qualification. |
| Chrome for Android | 150 | Works | Every required mapped BCD feature is available without a recorded qualification. |
| Firefox for Android | 152 | Works with limits | Every required mapped feature is available, but BCD records one or more qualifications. |
| Safari on iOS | 26.5 | Works | Every required mapped BCD feature is available without a recorded qualification. |
| Android WebView | 150 | Works | Every required mapped BCD feature is available without a recorded qualification. |
| Samsung Internet | 29.0 | Not supported | At least one required mapped feature is not available at this browser baseline. |
What this feature can and cannot do
Helps protect against
- Executable subresources without integrity metadata
- Incomplete SRI deployment coverage
Does not guarantee
- Incorrect but well-formed integrity metadata
- Compromise of the document that declares the policy
- Resource types outside the selected blocked destinations
What you need before using it
- SRI metadata on affected resources
- Reporting endpoints when policy reports are required
Fallback to keep in place
Inventory executable resources and enforce equivalent build-time checks where Integrity Policy is unavailable.