# Missing SRI integrity attribute on script tag allows CDN tampering

- **ID:** `security/missing-sri-integrity-attribute-allows-cdn-tampering`
- **Domain:** security
- **Category:** config_error
- **Verification:** ai_generated
- **Fix Rate:** 90%

## Root Cause

Script or link tags loading resources from a CDN lack the 'integrity' attribute, so a compromised CDN can serve malicious code without detection.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| Subresource Integrity spec (W3C) | active | — | — |
| Chrome 45+ | active | — | — |
| Firefox 43+ | active | — | — |
| Safari 13+ | active | — | — |
| Edge 17+ | active | — | — |

## Workarounds

1. **Add the 'integrity' attribute with the correct base64-encoded SHA-384 hash of the resource. Example: <script src='https://cdn.example.com/lib.js' integrity='sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC' crossorigin='anonymous'></script>** (90% success)
   ```
   Add the 'integrity' attribute with the correct base64-encoded SHA-384 hash of the resource. Example: <script src='https://cdn.example.com/lib.js' integrity='sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC' crossorigin='anonymous'></script>
   ```
2. **Self-host the resource instead of loading from a CDN to eliminate reliance on third-party integrity.** (95% success)
   ```
   Self-host the resource instead of loading from a CDN to eliminate reliance on third-party integrity.
   ```
3. **Use a CDN that supports SRI and automatically provides the integrity hash in the response headers.** (80% success)
   ```
   Use a CDN that supports SRI and automatically provides the integrity hash in the response headers.
   ```

## Dead Ends

- **** — The crossorigin attribute enables CORS but does not provide integrity verification; the resource can still be tampered with. (85% fail)
- **** — Different CDNs serve different content; the hash must match the exact resource. Using a different URL without updating the hash causes a SRI mismatch. (90% fail)
- **** — This removes all protection against CDN tampering, leaving the application vulnerable to supply-chain attacks. (95% fail)