Add SRI to React CDN links

[omerlh]

I noticed that the page listing react CDN links does not include SRI. I think that adding SRI attribute will encourage developers to use it and increase the awareness - especially for people who just do copy-paste from this website. SRI is the only way to ensure the integrity of the resource you're using - and it's recommend to use it when loading resources from a CDN.

[ahtee]

thats with the integrity attribute right? I've seen more source code / introductory tutorials having this as well.
However, since the CDN is through unpkg, im not aware of any ways unpkg can verify the integrity of the packages...

Should this also include crossorigin="anonymous"? Or is it that by default? Its unclear to me from checking mozilla docs. An invalid keyword and an empty string will be handled as the anonymous keyword. is the only thing i see..

https://developer.mozilla.org/en-US/docs/Web/HTML/CORS_settings_attributes

[omerlh]

There is no need to support by unpkg (as long as they support CORS, whcih seems they are). You can use any SRI generator site to generate the hash - for example, using this generator I get:

<script src="https://unpkg.com/react@16.8.5/umd/react.production.min.js" integrity="sha384-dOCiLz3nZfHiJj//EWxjwSKSC6Z1IJtyIEK/b/xlHVNdVLXDYSesoxiZb94bbuGE" crossorigin="anonymous"></script>

Yes, specifying the crossorigin attribute is mandatory, to mitigate a sophisticated attack. See the discussion here for more information.

Please note that the hash is changed each time the script changed - so publishing a new version will require also to update the doc. IMO it worth it, but not my call :)