Subresource Integrity (SRI): Defending against compromised CDN scripts using cryptographic hashes.

The CDN Compromise Attack Vector

Modern applications frequently load libraries (React, Bootstrap, jQuery, analytics) from third-party public Content Delivery Networks (CDNs). If an attacker compromises the CDN and alters the remote file, they instantly achieve Remote Code Execution across every website loading that script.

VULNERABLE (Blindly trusts remote CDN):
<script src="https://cdn.example.com/analytics.js"></script>
If cdn.example.com is hacked, attacker replaces script with keylogger!

SECURE (Subresource Integrity Enforced):
<script 
  src="https://cdn.example.com/analytics.js" 
  integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC" 
  crossorigin="anonymous">
</script>

How the Browser Evaluates SRI

1. The browser downloads analytics.js from the external CDN.
2. The browser computes the SHA-384 cryptographic digest of the received bytes.
3. If the computed hash does not match the integrity attribute byte-for-byte, the browser refuses to execute the script, terminates execution, and logs a security error in the console.
4. crossorigin="anonymous": Mandatory for SRI on cross-origin requests to prevent leaking file content cross-origin.