Subresource Integrity or SRI is a W3C recommendation to provide a method to protect website delivery. Specifically, it validates assets served by a third party, such as a content delivery network (CDN). This ensures these assets have not been compromised for hostile purposes.
To use SRI, a website author wishing to include a resource from a third party can specify a cryptographic hash of the resource in addition to the location of the resource. Browsers fetching the resource can then compare the hash provided by the website author with the hash computed from the resource. If the hashes don't match, the resource is discarded.
An integrity value may contain more than one space-separated hash expression. Each expression combines a hash algorithm name with a Base64-encoded digest; when several recognized algorithms are supplied, the user agent validates the response using the strongest algorithm in the list.
Subresource Integrity can be used with JavaScript files and linked stylesheets. When a resource is loaded from a different origin, integrity verification requires Cross-Origin Resource Sharing (CORS), with the server permitting access through the Access-Control-Allow-Origin response header. The crossorigin attribute enables the browser to request such resources in CORS mode.
A sample script element with integrity and crossorigin attribute used by the SRI:
<script src="https://cdn.example.com/app.js"
integrity="sha384-Tk2Yjg3YmYzMWNkZTdhMTFkM2FlNDg4ZjE3MzEzNTk3ZDlh"
crossorigin="anonymous">
</script>