What does a Subresource Integrity scanner check?
For an external script, the integrity attribute should contain a supported algorithm and valid encoded digest. Cross-origin SRI also depends on the resource being shared through CORS. DygDog checks observed metadata without downloading and executing every external script.
When is SRI a good fit?
SRI works best for versioned, immutable assets from a CDN or third party. If a vendor changes the file at the same URL, a pinned digest blocks the update until the page is updated. That is desirable for controlled assets but may conflict with deliberately dynamic vendor code.
How do SRI and CSP work together?
SRI verifies that a fetched resource matches expected content. CSP constrains which sources and execution patterns the page permits. Neither control replaces script inventory, vendor governance or change detection; they address different parts of browser-side supply-chain risk.
What DygDog checks
Missing integrity
Flags eligible external scripts without an integrity attribute.
Malformed metadata
Validates the observed algorithm-and-digest structure.
Crossorigin context
Reports cross-origin integrity use without the expected crossorigin attribute.
CSP relationship
Shows whether script-src meaningfully restricts executable sources.
Inventory drift
Reveals source or metadata changes between successful scans.
Coverage limits to understand
- The module does not prove that every external asset is safe.
- It does not fetch and independently recalculate each remote resource digest.
- Dynamic scripts may require a different integrity-assurance method agreed with your assessor.
Frequently asked questions
What is Subresource Integrity?
Subresource Integrity, or SRI, is a browser security feature that checks a fetched resource against cryptographic metadata supplied by the page.
Does SRI require crossorigin?
For resources fetched from another origin, browsers also perform CORS checks for SRI. The server must permit sharing and the element commonly uses crossorigin="anonymous".
Can SRI stop Magecart?
SRI can prevent execution when a protected static resource no longer matches its expected digest. It does not cover every script or every e-skimming route, so it should be part of defence in depth.