Slide 23 of 28
Part 4 · PreventionSlide 23
Slide 23 · MIT 05
Subresource Integrity — the browser verifies the script before executing it.
SRI is the direct technical defense against Magecart-style CDN script compromise.
What Subresource Integrity does

The HTML integrity attribute on a <script> or <link> tag specifies a cryptographic hash of the expected file content. Before executing the script, the browser downloads it and computes its hash. If the hash doesn’t match, the browser refuses to execute the script — even though it came from the expected domain. A CDN file that was modified by an attacker will have a different hash and will be blocked.

Implementation

With SRI, a Magecart-style modification to Inbenta’s CDN file would have caused the script to be blocked on every page load. The hash of the modified file wouldn’t match the hash in the integrity attribute. Users would see the widget fail to load — visible, alertable — rather than silently having their card data stolen.

⚠️
Limitation: hashes must be updated when files change
SRI hashes are static. When the vendor legitimately updates their script (bug fix, new feature), the hash changes and the old integrity value stops matching — breaking the integration until the hash is updated. This means SRI requires a process for tracking vendor updates and updating the hash. Some vendors publish their file hashes in release notes. Others support versioned URLs (pin to a specific version, not the latest).
🚨
Complement with Content Security Policy
Content Security Policy (CSP) with a script-src directive restricts which origins can load scripts. Combined with SRI, CSP ensures: (1) only scripts from approved origins are loaded, and (2) those scripts must match the expected hash. A CSP violation generates a report to your logging endpoint — alerting you to a potential CDN compromise attempt even if the browser blocked the script.
💼 Business takeaway

Ask your team whether any third-party JavaScript files loaded on your website have an integrity= attribute with a hash. Without it, a compromised CDN can silently replace the script with one that steals payment card data from your checkout page.

← Back MIT 06: Minimum-privilege integrations →