Integrity violation
The integrity-violation report fires when Integrity-Policy blocks a script that lacks valid Subresource Integrity metadata.
Last update:
An integrity-violation report tells you that Integrity-Policy blocked, or would
block, a script that was loaded without valid Subresource Integrity (SRI) metadata.
It is how you catch resources that could be swapped or tampered (for example a
compromised CDN asset) before they run.
Experimental
Integrity-Policy and its reporting are new and limited. Reporting to an endpoint works in Chrome and Edge; Firefox only logs to console and Safari does not support it.
When the browser sends it
When an Integrity-Policy (or Report-Only) document loads a script that has no valid
integrity attribute, or is requested in no-cors mode. Run
Integrity-Policy-Report-Only to see which scripts lack SRI before you enforce
blocking, so a roll-out does not break a legitimate but un-hashed script.
Setup
Reporting-Endpoints: integrity-endpoint="https://<Endpoint-ID>.report.centralcsp.com"Integrity-Policy-Report-Only: blocked-destinations=(script), endpoints=(integrity-endpoint)Payload example
{
"type": "integrity-violation",
"age": 5,
"url": "https://api-next.centralcsp.com/",
"user_agent": "Mozilla/5.0 ...",
"body": {
"documentURL": "https://api-next.centralcsp.com/",
"blockedURL": "https://api-next.centralcsp.com/example-framework.js",
"destination": "script",
"reportOnly": false
}
}Every integrity-violation report body carries these fields inside the shared report envelope.
Field reference
| Field | Meaning |
|---|---|
documentURL | The page the script loaded on. |
blockedURL | The script that lacked valid SRI. |
destination | The request destination (currently only script). |
reportOnly | true for a report-only policy, false when enforced. |
How to receive it
Integrity-Policy selects its reporting endpoints with the endpoints=() directive,
not the report-to= parameter the other policies use, and those names are declared
in Reporting-Endpoints. CentralCSP collects the
integrity stream; pair it with the
script inventory to know which scripts
already carry SRI.
What it tells you about security
A blocked script is a supply-chain signal: a CDN asset changed and no longer matches its hash, or a script loads without integrity protection at all. Either is exactly the tampering Integrity-Policy exists to catch, and the report names the script.
Gotchas
The reporting wiring uses endpoints=(), not the report-to= parameter used by
COOP, COEP, and Permissions-Policy. Currently only the script destination is
covered.
Browser support
Defined in the SRI spec; limited availability. Reporting to an endpoint works in Chrome and Edge; Firefox only logs to the console, and Safari does not support it.
See also
- Integrity-Policy
- Integrity-Policy explained (guide)
- Subresource Integrity (SRI)
- csp-hash report
- Integrity-Policy monitoring in CentralCSP
- Reporting-Endpoints header
- The report delivery format