CDN With SRI Secure

This demo pins the script with integrity. If the file is tampered, the browser refuses to execute it and logs an SRI error to the console.

Expectation: tampered file is blocked Check browser console for SRI error

SRI-Pinned Script

integrity + crossorigin

Why it’s good: the browser verifies the fetched file’s hash. Any modification (supply-chain attack, cache poison) causes a hard block.

  1. We deliberately set an incorrect hash for malicious_cdn/jquery.min.js.
  2. The browser prevents execution; the “Result” box should indicate it did not run.
  3. Use a build step to compute the correct hash and embed it.
Waiting for load…
View example manifest