Skip to main content
How Can We Help?
< All Topics
Print

Compute hashes for external assets

Posted
Updated
Byadmin

WARNING: Enabling automatic SRI can affect front-end behavior if external assets change unexpectedly or if a third-party host serves different content than anticipated. Review critical front-end pages after enabling this control, especially if the site depends on external JavaScript, CSS, or font providers.

Description of the control

Use this control to automatically compute SRI and crossorigin values for enqueued external scripts and styles. This helps browsers verify that supported external assets have not been altered and allows CMSSPM to cache known hashes for reuse. All computed hashes are cached and can be reviewed in the Known SRI resource hashes section.

Procedure

  1. Open Posture Management.
  2. Select Files, Malware & Integrity.
  3. In the Compute hashes for external assets card under Subresource Integrity, enable Automatically compute SRI/crossorigin values for enqueued external scripts and styles.
  4. In UA-variant hosts (per-user-agent SRI hashes), review the listed hosts and add any external hosts that serve different asset variants by user agent.
  5. Enter one host per line or use comma-separated values as needed.
  6. Review the help text noting that only HTTPS requests to non-local resources are scanned and that computed hashes are cached in the options table.
  7. After saving, review cached results in the Known SRI resource hashes section when you need to inspect the stored values.
  8. Select Save Settings.

Validation

Load a front-end page that uses external scripts or styles and confirm it still renders correctly after saving. Inspect the HTML output or browser developer tools and verify that supported external assets now include the expected integrity and crossorigin attributes where applicable. Also confirm that the generated hashes appear in the Known SRI resource hashes section for later review.

Table of Contents