Rewrites HTML files with SRI hashes
Clone or download
Type Name Latest commit message Commit time
Failed to load latest commit information.
test Removing paranoiaCheck as fix is now in chrome Dec 24, 2015
.eslintrc [FIXES #7] HTML should invalidate if any potential SRI input invalidates Nov 17, 2015
.snyk Updating packages to latest version and adding snyk Nov 17, 2015
.travis.yml add node 4, 5 Nov 17, 2015 Release 2.1.2 - Reenable snyk fixes #9 Mar 26, 2016 Add fingerprintCheck option and documentation Feb 13, 2016
appveyor.yml Correct appveyor path Jul 18, 2015
index.js Add fingerprintCheck option and documentation Feb 13, 2016
package.json Release 2.1.2 - Reenable snyk fixes #9 Mar 26, 2016

SRI for broccoli

build status build status npm status dependency status

This plugin looks at an apps html files to rewrite their content with integrity attributes.


  • origin - if crossorigin isn't specified but prepend is it will add an integrity if prepend starts with origin
  • crossorigin - adds a crossorigin attribute to script and link elements
    • This is required for CORS resources values are:
      • use-credentials
      • anonymous
  • prepend - resources with a full path will only get an applied integrity if the md5 checksum passes
  • paranoiaCheck - false by default, if enabled turns off the integrity attribute if any Unicode is found within the file
  • fingerprintCheck - true by default, if enabled validates the computed md5 checksum against the fingerprint


var sriTree = sri('path/to/code', {
  prefix: '',
  crossorigin: 'anonymous'


There was an encoding issue based on certain characters which is landed in Chrome 46 when using Chrome. This check fails if there is any non ASCII characters. On failure the file won't have a integrity attribute added. Please note this will be removed as a default in the future; with the desire to remove all of the checking code too.


If your assets change between the time they are fingerprinted and the time they are processed for SRI, you most likely want to disable this check. The canonical example is if an asset contains a link to a secondary asset and is rewritten to adjust the link after fingerprinting the second asset, rendering the fingerprint invalid (for anything more than a useful unique identifier).