# Integrity violation (/en/docs/web-security/reporting-api/reports/integrity-violation)



An `integrity-violation` report tells you that [Integrity-Policy](/en/docs/web-security/policies/integrity-policy) blocked, or would
block, a script that was loaded without valid Subresource Integrity (SRI) metadata.
It is how you catch resources that could be swapped or tampered (for example a
compromised CDN asset) before they run.

<Callout type="warn" title="Experimental">
  Integrity-Policy and its reporting are new and limited. Reporting to an endpoint works in Chrome and Edge; Firefox only logs to console and Safari does not support it.
</Callout>

## When the browser sends it [#when-the-browser-sends-it]

When an `Integrity-Policy` (or Report-Only) document loads a script that has no valid
`integrity` attribute, or is requested in `no-cors` mode. Run
`Integrity-Policy-Report-Only` to see which scripts lack SRI before you enforce
blocking, so a roll-out does not break a legitimate but un-hashed script.

## Setup [#setup]

```http
Reporting-Endpoints: integrity-endpoint="https://<Endpoint-ID>.report.centralcsp.com"
```

```http
Integrity-Policy-Report-Only: blocked-destinations=(script), endpoints=(integrity-endpoint)
```

## Payload example [#payload-example]

```json
{
  "type": "integrity-violation",
  "age": 5,
  "url": "https://example.com/",
  "user_agent": "Mozilla/5.0 ...",
  "body": {
    "documentURL": "https://example.com/",
    "blockedURL": "https://example.com/example-framework.js",
    "destination": "script",
    "reportOnly": false
  }
}
```

Every `integrity-violation` report body carries these fields inside the shared report envelope.

## Field reference [#field-reference]

| Field         | Meaning                                                 |
| ------------- | ------------------------------------------------------- |
| `documentURL` | The page the script loaded on.                          |
| `blockedURL`  | The script that lacked valid SRI.                       |
| `destination` | The request destination (currently only `script`).      |
| `reportOnly`  | `true` for a report-only policy, `false` when enforced. |

## How to receive it [#how-to-receive-it]

Integrity-Policy selects its reporting endpoints with the `endpoints=()` directive,
not the `report-to=` parameter the other policies use, and those names are declared
in [`Reporting-Endpoints`](/en/docs/web-security/reporting-api/headers/reporting-endpoints). CentralCSP collects the
[integrity stream](/en/docs/platform/monitoring/integrity-policy); pair it with the
[script inventory](/en/docs/platform/features/script-inventory) to know which scripts
already carry SRI.

## What it tells you about security [#what-it-tells-you-about-security]

A blocked script is a supply-chain signal: a CDN asset changed and no longer matches
its hash, or a script loads without integrity protection at all. Either is exactly
the tampering Integrity-Policy exists to catch, and the report names the script.

## Gotchas [#gotchas]

The reporting wiring uses `endpoints=()`, not the `report-to=` parameter used by
COOP, COEP, and Permissions-Policy. Currently only the `script` destination is
covered.

## Browser support [#browser-support]

Defined in the SRI spec; limited availability. Reporting to an endpoint works in
Chrome and Edge; Firefox only logs to the console, and Safari does not support it.

## See also [#see-also]

* [Integrity-Policy](/en/docs/web-security/policies/integrity-policy)
* [Integrity-Policy explained (guide)](/en/blog/integrity-policy-explained)
* [Subresource Integrity (SRI)](/en/docs/web-security/other/subresource-integrity)
* [csp-hash report](/en/docs/web-security/reporting-api/reports/csp-hash)
* [Integrity-Policy monitoring in CentralCSP](/en/docs/platform/monitoring/integrity-policy)
* [Reporting-Endpoints header](/en/docs/web-security/reporting-api/headers/reporting-endpoints)
* [The report delivery format](/en/docs/web-security/reporting-api/concepts/report-delivery-format)

## Sources [#sources]

* [MDN, IntegrityViolationReport](https://developer.mozilla.org/en-US/docs/Web/API/IntegrityViolationReport)
* [MDN, Integrity-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Integrity-Policy)
* [W3C, Subresource Integrity Integrity-Policy](https://w3c.github.io/webappsec-subresource-integrity/#integrity-policy-section)