#337 · Developer Tool

Subresource Integrity Tag Builder

Assemble a script or stylesheet element with an existing Subresource Integrity token. The builder validates the resource URL, integrity-token shape, crossorigin mode, and tag-specific attributes before producing copy-ready HTML. It defaults cross-origin resources to crossorigin="anonymous" and warns when a credentialed request is requested. Use a separately computed digest from the exact deployed bytes; placeholder hashes are rejected when they do not match SRI syntax.

Developer Input

Resource details
Ad space

How to use this developer tool

  1. Paste the resource details or load the included sample.
  2. Adjust any tool-specific option shown below the input.
  3. Select Build HTML Tag or press Ctrl/Cmd + Enter.
  4. Review the summary and findings, then copy or download the output.

What this developer tool does

Parses key=value settings, validates one or more SHA-2 integrity tokens, and emits an escaped script or link element.

Parses key=value settings, validates one or more SHA-2 integrity tokens, and emits an escaped script or link element.

The browser blocks the resource if its bytes do not match any listed digest or if cross-origin response settings are incompatible.

Example

Input

url=https://cdn.example.com/app.min.js
integrity=sha384-AbCdEf0123456789+/example==
crossorigin=anonymous
type=script
defer=yes

Output

<script src="https://cdn.example.com/app.min.js" integrity="sha384-…" crossorigin="anonymous" defer></script>

Use cases

  • Review a deployment before changing production response headers.
  • Compare application and reverse-proxy configuration.
  • Create a reproducible finding for a security review or pull request.
  • Teach the practical effect of Subresource Integrity Tag settings.

Tips for reliable output

  • Use the complete header value, including repeated fields.
  • Test the final response after CDN and proxy processing.
  • Keep a copy of the before and after output for review.
  • Do not treat a passing result as a penetration test.
  • Recheck after framework, server, or browser-policy updates.

Processing details

Supported type values are script and style. Script options include defer, async, and module; stylesheets are emitted as link rel="stylesheet".

The builder checks token form, not the digest against remote content. It also cannot verify a CDN Access-Control-Allow-Origin response.

Frequently asked questions

Why does an SRI script usually need crossorigin anonymous?

The checker reports this directly from the supplied resource details and shows the relevant value in its output.

Can I put more than one integrity hash in the attribute?

Use the result together with the browser and server behavior you support; the page does not make remote requests.

How do I build an SRI tag for a stylesheet?

Review the generated finding before deployment, especially when proxies or CDNs can alter headers.

Will the browser fall back if the integrity check fails?

The implemented rule follows current HTTP security-header practice and flags values it cannot recognize.

Can SRI be used with type module scripts?

Retest with the exact production response because small header changes can affect the conclusion.

Checks and output

StageWhat is reported
ParseRecognized input fields and values
ValidateInvalid, missing, or conflicting settings
ExportText, CSV, and JSON when structured data is available

HTTP & Security Headers

Browse more tools for HTTP behavior, browser policies, cookies, CORS, CSP, and response-header security.

View HTTP & Security Headers