Subresource Integrity
Lets a document require external scripts and stylesheets to match expected digests.
Support in current browsers
Checked against the current browser versions recorded in MDN browser data 8.0.7.
| Browser | Minimum | Outcome | Reason |
|---|---|---|---|
| Chrome | 150 | Works | Every required mapped BCD feature is available without a recorded qualification. |
| Edge | 150 | Works | Every required mapped BCD feature is available without a recorded qualification. |
| Firefox | 152 | Works | Every required mapped BCD feature is available without a recorded qualification. |
| Safari | 26.5 | Works | Every required mapped BCD feature is available without a recorded qualification. |
| Chrome for Android | 150 | Works | Every required mapped BCD feature is available without a recorded qualification. |
| Firefox for Android | 152 | Works | Every required mapped BCD feature is available without a recorded qualification. |
| Safari on iOS | 26.5 | Works | Every required mapped BCD feature is available without a recorded qualification. |
| Android WebView | 150 | Works | Every required mapped BCD feature is available without a recorded qualification. |
| Samsung Internet | 29.0 | Works | Every required mapped BCD feature is available without a recorded qualification. |
What this feature can and cannot do
Helps protect against
- Unexpected third-party resource modification
- CDN content substitution
Does not guarantee
- Resources intentionally updated without matching metadata
- Dynamic resources that cannot use stable digests
- Compromise of the page that supplies integrity metadata
What you need before using it
- Stable resource bytes
- Correct CORS behaviour where required
Fallback to keep in place
Self-host critical resources or apply other supply-chain and CSP controls when stable integrity metadata is impractical.