# Integrity-Policy header

The HTTP **`Integrity-Policy`** response header allows website administrators to ensure that all resources the user agent loads (of a certain type) have [Subresource Integrity](https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Subresource_Integrity) guarantees.

When set the user agent will block requests on specified [request destinations](#blocked-destinations) that omit integrity metadata, and will also block requests in [no-cors](https://developer.mozilla.org/en-US/docs/Web/API/Request/mode#no-cors) mode from ever being made.
This helps guard against content manipulation of fetched subresources.

Violations of the policy may be reported using the [Reporting API](https://developer.mozilla.org/en-US/docs/Web/API/Reporting_API).
Reports can be observed in the page for which the policy is being enforced, using a [`ReportingObserver`](https://developer.mozilla.org/en-US/docs/Web/API/ReportingObserver), and sent to server endpoints defined in a [Reporting-Endpoints](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Reporting-Endpoints) HTTP response header and selected using the [`endpoints`](#endpoints) field.
For more information see [IntegrityViolationReport](https://developer.mozilla.org/en-US/docs/Web/API/IntegrityViolationReport).

<table class="properties">
  <tbody>
    <tr>
      <th scope="row">Header type</th>
      <td>[Response header](https://developer.mozilla.org/en-US/docs/Glossary/Response%20header)</td>
    </tr>
  </tbody>
</table>

## Syntax

```http
Integrity-Policy: blocked-destinations=(<destination>),sources=(<source>),endpoints=(<endpoint>)
```

The header values are defined as structured field dictionaries with the following keys:

- `blocked-destinations`
  - : A list of [request destinations](https://developer.mozilla.org/en-US/docs/Web/API/Request/destination) that must include valid integrity metadata.
    Allowed values are:
    - `script`
      - : Script resources.
    - `style`
      - : Stylesheet resources.

- `sources` 
  - : A list of integrity sources that must include integrity metadata.
    Allowed values are:
    - `inline`
      - : The integrity metadata source is inline to the content, such as the [integrity attribute](https://developer.mozilla.org/en-US/docs/Web/API/HTMLScriptElement/integrity).
        This is the default.

        As this is the default and only value, omitting `sources` is equivalent to specifying `sources=(inline)`.

- `endpoints` 
  - : A list of [reporting endpoint names](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Reporting-Endpoints#endpoint) that indicate where reports will be sent.
    The reporting endpoints must be defined in a [Reporting-Endpoints](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Reporting-Endpoints) header.

## Examples

### Blocking and reporting when scripts lack integrity metadata

This example shows a document that blocks and reports to a server endpoint when any [script](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/script) (or `HTMLScriptElement`) does not specify an `integrity` attribute, or when a script resource is requested in [no-cors](https://developer.mozilla.org/en-US/docs/Web/API/Request/mode#no-cors) mode.

Note that the `integrity-endpoint` used in `Integrity-Policy` is defined in the [Reporting-Endpoints](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Reporting-Endpoints) header.

```http
Reporting-Endpoints: integrity-endpoint="https://example.com/integrity", backup-integrity-endpoint="https://report-provider.example/integrity"
Integrity-Policy: blocked-destinations=(script), endpoints=(integrity-endpoint backup-integrity-endpoint)
```

The [report payload](https://developer.mozilla.org/en-US/docs/Web/API/Reporting_API#reporting_server_endpoints) might look like this.

```json
{
  "type": "integrity-violation",
  "url": "https://example.com",
  "body": {
    "documentURL": "https://example.com",
    "blockedURL": "https://example.com/main.js",
    "destination": "script",
    "reportOnly": false
  }
}
```

## Specifications

## Browser compatibility

## See also

- [Integrity-Policy-Report-Only](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Integrity-Policy-Report-Only)
- [Reporting-Endpoints](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Reporting-Endpoints)
- [ReportingObserver](https://developer.mozilla.org/en-US/docs/Web/API/ReportingObserver)
- [IntegrityViolationReport](https://developer.mozilla.org/en-US/docs/Web/API/IntegrityViolationReport)
- [Integrity Policy](https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Subresource_Integrity#integrity_policy) in [Subresource Integrity](https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Subresource_Integrity#integrity_policy)
- [Reporting API](https://developer.mozilla.org/en-US/docs/Web/API/Reporting_API)