How Firefox SRI Protects Against Tampered CDN Scripts

This article explains how the Mozilla Firefox web browser utilizes Subresource Integrity (SRI) to protect users from malicious code injected into third-party Content Delivery Networks (CDNs). It covers the security risks of external scripts, the mechanics of cryptographic hash verification, the role of the HTML integrity attribute, and the exact step-by-step process Firefox executes to block tampered files from running on a webpage.

The Risk of Third-Party CDNs

Web developers frequently use Content Delivery Networks (CDNs) to host common JavaScript libraries. While this improves website loading speeds, it introduces a major security risk. If an attacker compromises a CDN and alters a popular script, every website fetching that script will unknowingly serve malicious code to its visitors. Subresource Integrity (SRI) is a security feature implemented in Firefox to eliminate this specific threat.

The Core Mechanism: Cryptographic Hashes

SRI relies on cryptographic hash functions—specifically SHA-256, SHA-384, or SHA-512. A cryptographic hash function takes a file (like a JavaScript script) and generates a unique, fixed-length string of characters based on the file's exact contents. This string acts as a digital fingerprint. If even a single comma or space in the original script is changed, the resulting hash will be completely different.

When a developer adds a third-party script to their website, they generate a hash of the known, safe version of that file. They then include this hash directly inside the HTML <script> tag using the integrity attribute.

An example of an SRI-protected script tag looks like this:

<script 
  src="https://example-cdn.com/framework.js" 
  integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC" 
  crossorigin="anonymous">
</script>

How Firefox Verifies the Script

When a user visits a webpage, the Firefox browser follows a strict, automated verification process before it allows any external script with an integrity attribute to run:

  1. Parsing the HTML: Firefox reads the webpage's HTML and identifies the <script> tag. It notes both the source URL of the CDN and the expected hash value defined in the integrity attribute.
  2. Enforcing CORS: Firefox checks for the crossorigin="anonymous" attribute. This ensures the browser fetches the script using Cross-Origin Resource Sharing (CORS), preventing sensitive user data (like cookies) from being sent to the third-party CDN during the request.
  3. Downloading the Resource: Firefox downloads the script file from the third-party CDN into its memory, holding it in quarantine before passing it to the JavaScript engine (SpiderMonkey).
  4. Calculating the Hash: Firefox reads the prefix of the integrity attribute (such as sha384-) to determine which hashing algorithm to use. The browser then applies this exact algorithm to the downloaded CDN file to calculate its current hash.
  5. Comparing the Fingerprints: Firefox compares the hash it just calculated from the downloaded file against the expected hash written in the website's HTML.

Execution or Termination

The final step in the Firefox SRI process depends entirely on the outcome of the hash comparison:

  • If the hashes match: Firefox confirms the file is identical to the one the web developer approved. The script is immediately passed to the JavaScript engine and executed normally.
  • If the hashes do not match: Firefox assumes the file has been tampered with or corrupted in transit. The browser immediately blocks the script from executing, protecting the user from potential malware or data theft. Firefox then logs a security error in the Developer Tools Web Console, alerting the developer that the subresource failed its integrity check.

Multiple Hashes and Algorithm Strength

Firefox also supports multiple hashes within a single integrity attribute. If a developer provides both a SHA-256 and a SHA-512 hash for the same file, Firefox is programmed to automatically select the strongest cryptographic algorithm it supports (in this case, SHA-512) to perform the verification. Furthermore, if a CDN uses multiple servers that might serve slightly different, yet safe, versions of a file, the developer can list multiple valid hashes of the same strength. Firefox will allow the script to run as long as the downloaded file matches at least one of the listed hashes.