The HTML integrity attribute on a <script> or <link> tag specifies a cryptographic hash of the expected file content. Before executing the script, the browser downloads it and computes its hash. If the hash doesn’t match, the browser refuses to execute the script — even though it came from the expected domain. A CDN file that was modified by an attacker will have a different hash and will be blocked.
With SRI, a Magecart-style modification to Inbenta’s CDN file would have caused the script to be blocked on every page load. The hash of the modified file wouldn’t match the hash in the integrity attribute. Users would see the widget fail to load — visible, alertable — rather than silently having their card data stolen.
script-src directive restricts which origins can load scripts. Combined with SRI, CSP ensures: (1) only scripts from approved origins are loaded, and (2) those scripts must match the expected hash. A CSP violation generates a report to your logging endpoint — alerting you to a potential CDN compromise attempt even if the browser blocked the script.Ask your team whether any third-party JavaScript files loaded on your website have an integrity= attribute with a hash. Without it, a compromised CDN can silently replace the script with one that steals payment card data from your checkout page.