Subresource Integrity (SRI)
A browser feature that verifies an external file (e.g. a JavaScript from a CDN) hasn't been tampered with — by comparing its content against a hash you've specified. If the hash doesn't match, the browser refuses to load the file. Protection against compromised CDNs and supply chains.
Problem: if your page loads a script from a third-party CDN you blindly trust that the CDN delivers exactly what you think — but if the CDN is hacked or the file is swapped (a supply-chain attack), the attacker's code runs on your page with your users' permissions. SRI solves it: you specify a cryptographic hash in the tag (integrity="sha384-..."), and the browser computes the hash on the downloaded file and runs it ONLY if it matches → tampered content is blocked automatically. Use case: all externally loaded scripts/stylesheets from CDNs. Limitation: it only works for files with fixed content (not things that change), and you must update the hash when you deliberately upgrade. A simple but effective control against front-end supply-chain attacks. Related to Content Security Policy and supply-chain attack.