Sri UI
This module helps protect your website by ensuring that any external files, like scripts and stylesheets loaded from content delivery networks, haven't been tampered with. It works by generating and applying cryptographic hashes to these files, allowing the browser to verify their integrity before loading them. This prevents malicious code injection through compromised external resources.
Subresource Integrity (SRI) is a security feature that enables browsers to verify that resources they fetch (for example, from a CDN) are delivered without unexpected manipulation. It works by allowing you to provide a cryptographic hash that a fetched resource must match.
How Subresource Integrity helps
Using Content Delivery Networks (CDNs) to host files such as scripts and stylesheets that are shared among multiple sites can improve site performance and conserve bandwidth. However, using CDNs also comes with a risk, in that if an attacker gains control of a CDN, the attacker can inject arbitrary malicious content into files on the CDN (or replace the files completely) and thus can also potentially attack all sites that fetch files from that CDN.
Subresource Integrity enables you to mitigate some risks of attacks such as this, by ensuring that the files your web application or web document fetches (from a CDN or anywhere) have been delivered without a third-party having injected any additional content into those files — and without any other changes of any kind at all having been made to those files.
Installation
- Download and install the module using Composer.
- Enable the module from the Extend page (`/admin/modules`) or via Drush.
Reference: Subresource Integrity - Security on the web | MDN
About this module
Provides a possibility to specify additional attributes to the libraries as required by Subresource Integrity rules
Configuration
- Navigate to the module configuration page at /admin/config/services/sri
- Enter the asset’s full URL in the required field and submit the form to generate the hash key.
- Alternatively, use the Drush command to update the hash key: drush update-assets-hash256