Subresource integrity

Subresource Integrity (SRI) is a security feature that enables browsers to verify that resources they fetch (for example, from a CDN) are delivered without unexpected manipulation. It works by allowing you to provide a cryptographic hash that a fetched resource must match.

Usage

First register the tag helpers in the _ViewImports.cshtml:

@addTagHelper *, Sidio.Web.Security.AspNetCore

And register the required services. By default, the hash algorithm is set to sha256 and the hash will be cached for 90 days.

builder.Services
    .AddSubresourceIntegrity();

Manually add integrity attributes

Then add the integrity taghelper attribute asp-add-subresource-integrity="true" to the script or link tag:

<link rel="stylesheet" href="https://example-cdn.com/bootstrap.min.css" asp-add-integrity="true" />
<script src="https://example-cdn.com/site.js" asp-add-integrity="true"></script>

Automatically add integrity attributes

Alternatively, the integrity attribute can be applied automatically to all script and link tags by configuring the tag helpers:

builder.Services
    .ConfigureTagHelpers(x => 
        {
            x.AutoApplySubresourceIntegrity = true;
        }
    );

Service configuration

builder.Services
    .AddSubresourceIntegrity(x => 
        {
            x.Algorithm = SubresourceHashAlgorithm.SHA512;
            x.AbsoluteExpiration = TimeSpan.FromDays(180);
        }
    );

Security notice

⚠️ The integrity hash by this service is generated by the server by requesting the resource. Because the resource can be malicious at the time the resource is requested, this feature is not 100% secure. It is recommended to generate and apply the SRI hashes manually.

References

• Mozilla web docs