CDN link integrity and crossorigin

[fulldecent]

In Bootstrap documentation, the recommended code to link using CDN is:

<link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha1/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-GLhlTQ8iRABdZLl6O3oVMWSktQOp6b7In1Zl3/Jr59b6EGGoI1aFkw7cmDA6j6gD" crossorigin="anonymous">

However the same code on Bootstrap Icons documentation is:

<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.10.3/font/bootstrap-icons.css">

---

Please update the latter to include the best practice elements of the former. Specifically the integrity= and crossorigin= parts.

Previously I would ignore whatever the recommended code was and run over to jsDelivr myself to get the required sha256 parts. However now with the jsDelivr website redesign, they have specifically made it harder to get this thing.

[y377]

Please forgive me for not understanding this, what are the advantages and disadvantages of adding these two attributes?

[fulldecent]

When you visit a website EXAMPLE.COM using Bootstrap Icons, your browser will download those icons from jsDelivr if the EXAMPLE.COM author used the recommended setting on the Bootstrap Icons homepage.

If jsDelivr is ever compromised, it could serve a different file, and the EXAMPLE.COM website would also be compromised.

We can avoid this by using SRI integrity. If the wrong file is served, the visitor will reject that file as unexpected.

---

For crossorigin this prevents jsDelivr from putting cookies on everybody's website that uses Bootstrap Icon (with current recommended install settings).

---

The disadvantage is that when copy/pasting there are more letters in the code to copy/paste.

[y377]

I see, thank you for the science

[MartyIX]

It would be great to have this integrity attribute. It appears that one can use https://www.srihash.org to manually get the integrity attribute.