CodePark/ questions / Supply chain & third-party scripts
START PRACTICINGPRACTICE
Frontend question · Frontend security › Supply chain & third-party scripts

Why does this tag need crossorigin="anonymous", and when is Subresource Integrity the wrong tool?

<script
  src="https://cdn.example.com/lib@3.2.1/lib.min.js"
  integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC"
  crossorigin="anonymous"></script>
The integrity check on a file from another origin needs a CORS response, and SRI breaks when a file changes at the same URL, like a vendor's auto-updating snippet

For a file from another origin, the browser checks the hash only on a CORS response. crossorigin="anonymous" asks for one, without cookies. SRI blocks the file if even one byte changes. That is perfect for a pinned version like lib@3.2.1. It is wrong for a URL whose content the vendor updates, because your page would break on their next release.

"crossorigin sends your cookies to the CDN" is the tempting wrong answer. anonymous means no credentials, and versioned URLs are where SRI fits best.