require-sri-for
The CSP require-sri-for directive would have required Subresource Integrity on scripts and styles. Use the Integrity-Policy header instead.
Last update:
The require-sri-for Content Security Policy (CSP) directive would have forced
Subresource Integrity (SRI)
checks on scripts and stylesheets, blocking any that lacked an integrity
attribute. It never shipped to a stable browser and was abandoned.
Deprecated
require-sri-for never shipped to stable; it existed only behind an experimental Chrome flag and was abandoned over compatibility risk (too many pages would break once the requirement turned on). The design was folded into the Integrity-Policy header, which is the replacement.
Use the replacement instead:
Integrity-Policy: blocked-destinations=(script)What you should do instead
Use the Integrity-Policy header, which took over the same goal: requiring SRI on the resources a page loads. The example above blocks scripts that lack integrity metadata.
Delete require-sri-for from any policy that still carries it; it has no
effect in any browser. To add the integrity attributes themselves, our
SRI guide covers the
mechanics, and the SRI generator computes the hashes
for you.
Why it was removed
require-sri-for only ever ran behind an experimental flag in Chrome and never
reached stable in any browser. It was abandoned over compatibility risk: too
many pages would break the moment the requirement turned on. The design was
later folded into the Integrity-Policy header, which ships with a
report-only variant so sites can measure breakage before enforcing.
Browser support
No browser supports require-sri-for. It existed only behind an experimental
Chrome flag and was never shipped by Firefox or Safari. The
Integrity-Policy header is
the supported way to require SRI.
See also
- Integrity-Policy, the header that replaced it
- Subresource Integrity
- Directives index
- Generate SRI hashes with the SRI generator
Sources
referrer
The CSP referrer directive was a pre-CSP3 experiment for controlling the Referer header. Use the Referrer-Policy header instead.
Cross-Origin-Opener-Policy
COOP isolates your window from cross-origin openers and popups, defending against cross-window attacks and enabling cross-origin isolation.