WPT
wpt / subresource-integrity / subresource-integrity.html
Spec: SRI ↗
Runs: Chrome 155.0.8041.0 (wpt@2c385f65e, 2026-09-04) | Firefox 157.0a1 (wpt@2c385f65e, 2026-09-04) | Safari 251 preview (wpt@5ce815a83, 2026-08-27) | Ladybird 1.0-a7825 (wpt@2c385f65e, 2026-09-04) | Servo Servo 0.6 (wpt@7e3d005d7, 2026-09-03) | Blitz a50cb8971 (wpt@a95401e4e, 2026-09-03)
View on the Blitz WPT dashboard | Open test on wpt.live | wpt.fyi
| Chrome | Firefox | Safari | Ladybird | Servo | Blitz | |
|---|---|---|---|---|---|---|
| Total | 48/48 | 48/48 | 48/48 | 46/48 | 48/48 | NOT RUN |
| Subtest | Chrome | Firefox | Safari | Ladybird | Servo | Blitz |
|---|---|---|---|---|---|---|
| Script: Same-origin with correct sha256 hash. | PASS | PASS | PASS | PASS | PASS | — |
| Script: Same-origin with correct sha384 hash. | PASS | PASS | PASS | PASS | PASS | — |
| Script: Same-origin with correct sha512 hash. | PASS | PASS | PASS | PASS | PASS | — |
| Script: Same-origin with empty integrity. | PASS | PASS | PASS | PASS | PASS | — |
| Script: Same-origin with non-Base64 hash. | PASS | PASS | PASS | FAIL | PASS | — |
| Script: Same-origin with incorrect hash. | PASS | PASS | PASS | PASS | PASS | — |
| Script: Same-origin with incorrect integrity => cleared after prepare. | PASS | PASS | PASS | PASS | PASS | — |
| Script: Same-origin with incorrect integrity => set to correct hash after prepare. | PASS | PASS | PASS | PASS | PASS | — |
| Script: Same-origin with empty integrity => set to incorrect hash after prepare. | PASS | PASS | PASS | PASS | PASS | — |
| Script: Same-origin with correct integrity => set to incorrect hash after prepare. | PASS | PASS | PASS | PASS | PASS | — |
| Script: Same-origin with multiple sha256 hashes, including correct. | PASS | PASS | PASS | PASS | PASS | — |
| Script: Same-origin with multiple sha256 hashes, including unknown algorithm. | PASS | PASS | PASS | PASS | PASS | — |
| Script: Same-origin with sha256 mismatch, sha512 match | PASS | PASS | PASS | PASS | PASS | — |
| Script: Same-origin with sha256 match, sha512 mismatch | PASS | PASS | PASS | PASS | PASS | — |
| Script: <crossorigin='anonymous'> with correct hash, ACAO: * | PASS | PASS | PASS | PASS | PASS | — |
| Script: <crossorigin='anonymous'> with incorrect hash, ACAO: * | PASS | PASS | PASS | PASS | PASS | — |
| Script: <crossorigin='use-credentials'> with correct hash, CORS-eligible | PASS | PASS | PASS | PASS | PASS | — |
| Script: <crossorigin='use-credentials'> with incorrect hash CORS-eligible | PASS | PASS | PASS | PASS | PASS | — |
| Script: <crossorigin='anonymous'> with CORS-ineligible resource | PASS | PASS | PASS | PASS | PASS | — |
| Script: Cross-origin, not CORS request, with correct hash | PASS | PASS | PASS | PASS | PASS | — |
| Script: Cross-origin, not CORS request, with hash mismatch | PASS | PASS | PASS | PASS | PASS | — |
| Script: Cross-origin, empty integrity | PASS | PASS | PASS | PASS | PASS | — |
| Script: Same-origin with correct hash, options. | PASS | PASS | PASS | PASS | PASS | — |
| Script: Same-origin with unknown algorithm only. | PASS | PASS | PASS | PASS | PASS | — |
| Style: Same-origin with correct sha256 hash | PASS | PASS | PASS | PASS | PASS | — |
| Style: Same-origin with correct sha384 hash | PASS | PASS | PASS | PASS | PASS | — |
| Style: Same-origin with correct sha512 hash | PASS | PASS | PASS | PASS | PASS | — |
| Style: Same-origin with empty integrity | PASS | PASS | PASS | PASS | PASS | — |
| Style: Same-origin with non-Base64 integrity | PASS | PASS | PASS | FAIL | PASS | — |
| Style: Same-origin with incorrect hash. | PASS | PASS | PASS | PASS | PASS | — |
| Style: Same-origin with multiple sha256 hashes, including correct. | PASS | PASS | PASS | PASS | PASS | — |
| Style: Same-origin with multiple sha256 hashes, including unknown algorithm. | PASS | PASS | PASS | PASS | PASS | — |
| Style: Same-origin with sha256 mismatch, sha512 match | PASS | PASS | PASS | PASS | PASS | — |
| Style: Same-origin with sha256 match, sha512 mismatch | PASS | PASS | PASS | PASS | PASS | — |
| Style: <crossorigin='anonymous'> with correct hash, ACAO: * | PASS | PASS | PASS | PASS | PASS | — |
| Style: <crossorigin='anonymous'> with incorrect hash, ACAO: * | PASS | PASS | PASS | PASS | PASS | — |
| Style: <crossorigin='use-credentials'> with correct hash, CORS-eligible | PASS | PASS | PASS | PASS | PASS | — |
| Style: <crossorigin='use-credentials'> with incorrect hash CORS-eligible | PASS | PASS | PASS | PASS | PASS | — |
| Style: <crossorigin='anonymous'> with CORS-ineligible resource | PASS | PASS | PASS | PASS | PASS | — |
| Style: Cross-origin, not CORS request, with correct hash | PASS | PASS | PASS | PASS | PASS | — |
| Style: Cross-origin, not CORS request, with hash mismatch | PASS | PASS | PASS | PASS | PASS | — |
| Style: Cross-origin, empty integrity | PASS | PASS | PASS | PASS | PASS | — |
| Style: Same-origin with correct hash, options. | PASS | PASS | PASS | PASS | PASS | — |
| Style: Same-origin with unknown algorithm only. | PASS | PASS | PASS | PASS | PASS | — |
| Style: Same-origin with correct sha256 hash, rel='stylesheet license' | PASS | PASS | PASS | PASS | PASS | — |
| Style: Same-origin with correct sha256 hash, rel='license stylesheet' | PASS | PASS | PASS | PASS | PASS | — |
| Style: Same-origin with correct sha256 and sha512 hash, rel='alternate stylesheet' enabled | PASS | PASS | PASS | PASS | PASS | — |
| Style: Same-origin with incorrect sha256 and sha512 hash, rel='alternate stylesheet' enabled | PASS | PASS | PASS | PASS | PASS | — |