Integrity-Policy header

The HTTP Integrity-Policy response header allows website administrators to ensure that all resources the user agent loads (of a certain type) have Subresource Integrity guarantees.

When set the user agent will block requests on specified request destinations that omit integrity metadata, and will also block requests in no-cors mode from ever being made. This helps guard against content manipulation of fetched subresources.

Violations of the policy may be reported using the Reporting API. Reports can be observed in the page for which the policy is being enforced, using a ReportingObserver, and sent to server endpoints defined in a Reporting-Endpoints HTTP response header and selected using the endpoints field. For more information see IntegrityViolationReport.

Header type	[Response header](https://developer.mozilla.org/en-US/docs/Glossary/Response%20header)

Syntax

Integrity-Policy: blocked-destinations=(<destination>),sources=(<source>),endpoints=(<endpoint>)

The header values are defined as structured field dictionaries with the following keys:

blocked-destinations
- : A list of request destinations that must include valid integrity metadata. Allowed values are:
  - script
    - : Script resources.
  - style
    - : Stylesheet resources.
sources
- : A list of integrity sources that must include integrity metadata. Allowed values are:
  - inline
    - : The integrity metadata source is inline to the content, such as the integrity attribute. This is the default.
      
      As this is the default and only value, omitting sources is equivalent to specifying sources=(inline).
endpoints
- : A list of reporting endpoint names that indicate where reports will be sent. The reporting endpoints must be defined in a Reporting-Endpoints header.

Examples

Blocking and reporting when scripts lack integrity metadata

This example shows a document that blocks and reports to a server endpoint when any script (or HTMLScriptElement) does not specify an integrity attribute, or when a script resource is requested in no-cors mode.

Note that the integrity-endpoint used in Integrity-Policy is defined in the Reporting-Endpoints header.

Reporting-Endpoints: integrity-endpoint="https://example.com/integrity", backup-integrity-endpoint="https://report-provider.example/integrity"
Integrity-Policy: blocked-destinations=(script), endpoints=(integrity-endpoint backup-integrity-endpoint)

The report payload might look like this.

{
  "type": "integrity-violation",
  "url": "https://example.com",
  "body": {
    "documentURL": "https://example.com",
    "blockedURL": "https://example.com/main.js",
    "destination": "script",
    "reportOnly": false
  }
}

HTTP: Hypertext Transfer Protocol

HTTP guides

HTTP authentication

Browser detection using the user agent string (UA sniffing)

HTTP caching

HTTP Client hints

Compression in HTTP

Compression Dictionary Transport

HTTP conditional requests

Connection management in HTTP/1.x

Content negotiation

List of default Accept values

Using HTTP cookies

Cross-Origin Resource Sharing (CORS)

CORS errors

Reason: CORS header 'Access-Control-Allow-Origin' does not match 'xyz

Reason: CORS request did not succeed

Reason: CORS disabled

Reason: CORS request external redirect not allowed

Reason: invalid token 'xyz' in CORS header 'Access-Control-Allow-Headers

Reason: invalid token 'xyz' in CORS header 'Access-Control-Allow-Methods

Reason: Did not find method in CORS header 'Access-Control-Allow-Methods

Reason: expected 'true' in CORS header 'Access-Control-Allow-Credentials

Reason: missing token 'xyz' in CORS header 'Access-Control-Allow-Headers' from CORS preflight channel

Reason: CORS header 'Access-Control-Allow-Origin' missing

Reason: Multiple CORS header 'Access-Control-Allow-Origin' not allowed

Reason: Credential is not supported if the CORS header 'Access-Control-Allow-Origin' is '*

Reason: CORS header 'Origin' cannot be added

Reason: CORS preflight channel did not succeed

Reason: CORS request not HTTP

Content Security Policy (CSP)

Content Security Policy errors and warnings

Content Security Policy: The page's settings blocked the loading of a resource: xyz

Evolution of HTTP

Fetch metadata

IFrame credentialless

HTTP messages

Media types (MIME types)

Common media types

Network Error Logging (NEL)

Overview of HTTP

Permissions Policy

Protocol upgrade mechanism

Proxy servers and tunneling

Proxy Auto-Configuration (PAC) file

HTTP range requests

Redirections in HTTP

A typical HTTP session

User-Agent reduction

HTTP reference

HTTP headers

Accept header

Accept-CH header

Accept-Encoding header

Accept-Language header

Accept-Patch header

Accept-Post header

Accept-Query header

Accept-Ranges header

Access-Control-Allow-Credentials header

Access-Control-Allow-Headers header

Access-Control-Allow-Methods header

Access-Control-Allow-Origin header

Access-Control-Expose-Headers header

Access-Control-Max-Age header

Access-Control-Request-Headers header

Access-Control-Request-Method header

Activate-Storage-Access header

Age header

Allow header

Alt-Svc header

Alt-Used header

Attribution-Reporting-Eligible header

Attribution-Reporting-Register-Source header

Attribution-Reporting-Register-Trigger header

Authorization header

Available-Dictionary header

Cache-Control header

Clear-Site-Data header

Connection header