CS Fundamentals Trainer · JavaScript · Security

A page includes <script src="https://cdn.example/lib.js" integrity="sha384-..." crossorigin="anonymous">, but the CDN now serves a file…

A page includes `<script src="https://cdn.example/lib.js" integrity="sha384-..." crossorigin="anonymous">`, but the CDN now serves a file whose hash doesn't match. What does the browser do?

  1. It executes the script but logs a console warning, since integrity checks are advisory.
  2. It refuses to execute the script and fires an `error` event on the `<script>` element.
  3. It downloads the same path from the page's own origin as a fallback and runs that.
  4. It executes the script in a sandbox without access to the page's DOM.

Difficulty: easy

Answer this question

Related questions