HTML Code

<!DOCTYPE html>
<html lang=en>
<head>
  <meta charset=UTF-8>
  <meta name=viewport content="width=device-width,initial-scale=1">
  <title>integrity — external script</title>
  <style>body{font-family:system-ui,sans-serif;margin:0;padding:1.5rem;background:#f8fafc;color:#334155;line-height:1.7}h1{margin:0 0 1rem;font-size:1.25rem;color:#0f172a}.panel{max-width:520px;padding:1rem 1.25rem;background:#fff;border:1px solid #e2e8f0;border-radius:8px;font-size:.8125rem}code{background:#e2e8f0;padding:.1rem .35rem;border-radius:4px;word-break:break-all}.hint{margin-top:1rem;font-size:.8125rem;color:#64748b;max-width:520px}</style>
</head>
<body>
  <h1>integrity on &lt;script&gt;</h1>
  <div class=panel>
    <pre style=margin:0;white-space:pre-wrap;font-family:ui-monospace,monospace;font-size:.75rem;line-height:1.6>&lt;script
  src="https://cdn.example.com/lib.js"
  integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC"
  crossorigin="anonymous"&gt;&lt;/script&gt;</pre>
  </div>
  <p class=hint>Replace the hash with one generated from the <em>exact</em> file bytes. Mismatch blocks the script. Pair with <code>crossorigin="anonymous"</code> for cross-origin SRI.</p>
</body>
</html>

Lines: 0 | Characters: 0

Live Preview Auto-refresh on Run

HTML integrity Attribute — Secure External Script (SRI)