# Subresource Integrity (SRI)
Subresource Integrity (SRI) is a World Wide Web Consortium (W3C) security standard that allows web developers to cryptographically verify the exact content of external scripts and stylesheets before browsers execute or apply them. Published as a W3C Recommendation in 2016, SRI addresses a fundamental weakness in how modern web applications load third-party code: the implicit trust relationship between a website and every Content Delivery Network (CDN) it relies upon.
SRI exists because web applications routinely load JavaScript libraries, CSS frameworks, and other resources from external origins they do not control. A single compromised CDN can inject malicious code into thousands of websites simultaneously. Traditional transport security (HTTPS) and origin controls (Content Security Policy) verify that content arrives from the expected domain over an encrypted connection, but neither mechanism validates that the content itself matches what the developer intended to load. An attacker who compromises a CDN account or exploits a vulnerability in the CDN's infrastructure can serve modified content over a perfectly valid HTTPS connection from a trusted domain.
SRI interrupts this attack vector by embedding a cryptographic hash directly in the HTML element that requests the resource. When the browser fetches the external file, it computes a hash of the received bytes and compares it to the hash specified by the developer. If the hashes match, the resource loads normally. If they differ, the browser discards the resource entirely and generates a network error. This verification happens at the browser level, making it independent of network infrastructure, proxies, or server-side controls.
The standard applies specifically to resources loaded via