Using SRI with jsDelivr

Subresource Integrity (SRI) is a security feature that enables browsers to verify that files they fetch are delivered without unexpected manipulation. It works by allowing you to provide a cryptographic hash that a fetched file must match.

When is it safe to use SRI with jsDelivr

Because SRI verifies full contents of the file, changing even one byte will cause the verification to fail. For this reason, you must only use SRI with links that are guaranteed to never change. Only use SRI with full single-file links, and static versions. For example:

<script src="https://cdn.jsdelivr.net/npm/jquery@3.2.1/dist/jquery.min.js" integrity="sha256-hwg4gsxgFZhOsEEamdOYGBf13FyQuiTwlAQgxVSNgt4="></script>

Do NOT use SRI with

The purpose of version aliasing is getting automatic updates. This obviously means the code can change any time.

Default file are automatically minified, so the reasons for minified files apply here as well.

Minifying the exact same source code multiple times might not result in the exact same generated code. While we store all generated files in our permanent storage, we might need to re-minify the file in certain situation, e.g., as a part of failover, if our storage provider goes down.

Combining the exact same source code multiple times might not result in the exact same generated code. There might be subtle changes over time, e.g. in added whitespace, caused by changes in our code. While we store all generated files in our permanent storage, we might need to re-combine the files in certain situation, e.g., as a part of failover, if our storage provider goes down.