Integrity-Policy header

The HTTP Integrity-Policy response header allows website administrators to ensure that all resources the user agent loads (of a certain type) have Subresource Integrity guarantees.

When set the user agent will block requests on specified request destinations that omit integrity metadata, and will also block requests in no-cors mode from ever being made.

Violation reports may also be sent to if the header includes a reporting endpoint name that matches an endpoint declared using the Reporting-Endpoints header. Reports are generated using the Reporting API, and may also be observed in the page for which the integrity policy is being enforced, using a ReportingObserver. The format of the report body is given by the IntegrityViolationReportBody dictionary (a JSON-serialized form of this body is sent in POSTs to reporting server endpoints).

This helps guard against content manipulation of fetched subresources.

Header type	Response header
Forbidden request header	no

Syntax

http

Integrity-Policy: blocked-destinations=(<destination>),sources=(<source>),endpoints=(<endpoint>)

The header values are defined as structured field dictionaries with the following keys:

blocked-destinations

A list of request destinations that must include valid integrity metadata. Allowed values are:

script: Script resources.

sources Optional

A list of integrity sources that must include integrity metadata. Allowed values are:

inline

The integrity metadata source is inline to the content, such as the integrity attribute. This is the default.

As this is the default and only value, omitting sources is equivalent to specifying sources=(inline).

endpoints Optional

A list of reporting endpoint names that indicate where reports will be sent. The reporting endpoints must be defined in a Reporting-Endpoints header.

Examples

Blocking and reporting when scripts lack integrity metadata

This example shows a document that blocks and reports when any <script> (or HTMLScriptElement) does not specify an integrity attribute, or when a script resource is requested in no-cors mode.

Note that the integrity-endpoint used in Integrity-Policy is defined in the Reporting-Endpoints header.

http

Reporting-Endpoints: integrity-endpoint=https://example.com/integrity, backup-integrity-endpoint=https://report-provider.example/integrity
Integrity-Policy: blocked-destinations=(script), endpoints=(integrity-endpoint, backup-integrity-endpoint)

The report payload might look like this.

json

{
  "type": "integrity-violation",
  "url": "https://example.com",
  "body": {
    "documentURL": "https://example.com",
    "blockedURL": "https://example.com/main.js",
    "destination": "script",
    "reportOnly": false
  }
}

Specifications

Specification
Subresource Integrity # integrity-policy-section