Comparison
Content Security PolicyvsSubresource integrity
Content Security Policy
an injected script was blocked because the browser refused to run anything from an origin not on the list.
A response header declaring which sources of script, style, image and connection the page may use, enforced by the browser. It is a second line of defence: it does not prevent injection, it prevents the injected thing from doing anything useful. Rolling one out realistically means starting in report-only mode, because inline scripts, inline event handlers and `eval` in dependencies all break under a strict policy.
Full entry →Subresource integrity
the script tag carries a hash and the browser refuses to run the file if it does not match.
A hash on a script or stylesheet tag that the browser verifies before executing the fetched file. It is the defence against a CDN or a third-party host serving something other than what you expected. It only works for files that never change, so a versioned library URL can use it and a rolling `latest` URL cannot.
Full entry →