Subresource Integrity (SRI)
PCIComplianceHubLast updated
An HTML attribute that pins a script or stylesheet to a cryptographic hash of its expected contents, so the browser refuses to execute the file if it has been altered. Written as an integrity attribute carrying a sha384 hash on a script or link tag. SRI answers the integrity half of Requirement 6.4.3 directly for files whose contents are stable. It cannot be used on a script the provider updates without notice, because any legitimate change breaks the hash, which is why tag managers and analytics loaders need a different control.
Applies to. Scripts and stylesheets loaded from an address whose contents are meant to be fixed: a pinned library version on a CDN, or a file the entity builds itself.
Example. A script tag with src pointing at a versioned library, an integrity attribute carrying a sha384 hash of that file, and crossorigin="anonymous" for a cross-origin host. If the file at that address changes by a byte, the browser refuses to run it.
Limits. SRI checks a file against a hash the page author wrote, so it protects against the file changing, not against an attacker who can edit the page and the hash together. A resource its provider updates in place cannot be pinned, because every legitimate update breaks the hash; tag managers and analytics loaders are usually in that category and need authorisation, an inventory and change detection instead. Scripts that another script inserts at run time carry no integrity attribute unless the inserting code sets one, which third-party loaders rarely do.
In PCI DSS v4.0.1. 6.4.3 (Payment page script inventory)