The integrity attribute is a small instruction attached to an HTML element. Its job is to expected cryptographic digest of an external asset. It is easier to remember when you can see it in a real piece of markup.
What integrity is used for
Expected cryptographic digest of an external asset. The attribute appears inside an element’s opening tag. Depending on its definition, it may take a specific string, a number, an enumerated keyword, or be a boolean attribute.
The example below uses it in a script context. Other elements may support it too, or may give the same attribute a different meaning.
Example you can try
<!-- Replace placeholder with the real build-generated hash. -->
<script src="/js/app.js" integrity="sha384-REPLACE_WITH_REAL_HASH" crossorigin="anonymous" defer></script>How the example works
Look for integrity in the snippet. Here the example shows the value sha384-REPLACE_WITH_REAL_HASH. This is a concrete input the browser can interpret; it is not just text shown to the reader.
A placeholder hash intentionally fails verification. Generate a real digest from the exact file before deployment.
Values and important behavior
Use the value format shown by the HTML definition. Do not assume that a value accepted in one attribute also works in another. When a browser ignores an invalid value, inspect the element and correct the markup.
This detail matters most when the page receives user input, navigates to another document, or loads an external resource. In those cases, check the browser behavior and any server-side requirements separately.
Small practice task
Copy the code and change integrity to another sensible value, or remove it entirely if it is optional. Test the difference in the browser and inspect any submitted value or network request.
Common Beginner Mistakes
- A placeholder hash intentionally fails verification. Generate a real digest from the exact file before deployment.
- Using
integrityon an element that does not support it. - Believing that an HTML hint or client-side check replaces real server validation or a security policy.
Key Takeaways
integrityis used to expected cryptographic digest of an external asset.- A placeholder hash intentionally fails verification. Generate a real digest from the exact file before deployment.
- Choose valid values and test the result instead of guessing what the browser will do.