Integrity and crossorigin attributes

[quivis]

Gemini repeatedly introduces BS5 js and css calls that include integrity and crossorigin attributes but I can find precious little about them [i.e. nothing] here. Are they necessary? or a good idea and if so how does one go about generating them?

[julien-deramond]

The integrity attribute enables Subresource Integrity (SRI)—it verifies that a fetched JS or CSS file hasn't been tampered with by checking its cryptographic hash. This is not the main topic, but there is some information about why integrity is important (and how to generate it) when using Bootstrap at Download > Alternative CDNs.

crossorigin="anonymous" is needed when loading from a CDN so the browser can fetch the file and still verify its integrity.

They're not required, but strongly recommended for third-party resources to prevent supply chain attacks.

[quivis]

Thanks Julien. I'm only surprised that Bootstrap itself does not do more to promote integrity and crossorigin attribution so I will certainly look at your download > alternative cdn link.

[jonhubby]

Just to add to what Julien said, if you're using a CDN like jsDelivr or CDNJS, they usually provide the integrity attribute with the link. For self-hosted files, you can generate the hash using a tool like SRI Hash Generator. Keep in mind that even small changes to the file will require a new hash. Using integrity with crossorigin="anonymous" is a solid way to protect against unexpected changes or supply chain attacks.

[quivis]

Many thanks jonhubby - all grist for the proverbial.

…

On Sat, 31 May 2025 at 11:49, jonhubby ***@***.***> wrote: Just to add to what Julien said, if you're using a CDN like jsDelivr or CDNJS, they usually provide the integrity attribute with the link. For self-hosted files, you can generate the hash using a tool like SRI Hash Generator <https://www.srihash.org/>. Keep in mind that even small changes to the file will require a new hash. Using integrity with crossorigin="anonymous" is a solid way to protect against unexpected changes or supply chain attacks. — Reply to this email directly, view it on GitHub <#41454 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AKXS5YTQQWEALTSHBWTAQ533BGCMBAVCNFSM6AAAAAB4V6G2CWVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTGMZSHA2TMMY> . You are receiving this because you authored the thread.Message ID: ***@***.***>