A permitted CDN can serve a changed script after the website was signed off. If a supplier proposes integrity pinning, agree who approves an update and how a failed load is handled. Trusting an origin and approving exact bytes are different procurement decisions.
Source-bound fact
Subresource integrity compares a resource with its supplied hash; cross-origin use also requires CORS support. Official reference · Checked 17 October 2026.
Filled synthetic acceptance example
Synthetic teaching example, not a client case or a real-platform assessment. On narrow screens, scroll to read the complete table.
| Input | Check basis | Expected |
|---|---|---|
| Approved syntheticwidgetv1; matching hash | exact byte comparison | integrity candidate |
| One byte changed but old hash retained | hash mismatch | block candidate; investigate update |
| Cross-origin response lacks CORS support | hash match insufficient | supplier compatibility check required |
Supplier acceptance procedure
- Record the immutable resource version, reviewed bytes and responsible approver.
- Test a deliberate mismatch in an isolated environment and confirm the interface has an honest fallback.
- Review cross-origin headers and the update procedure; do not automatically recalculate a hash to accept unknown code.
Interpret the output
The tool computes real SHA-256 for supplied synthetic text. That proves the digest calculation only, not that a widget is safe or that a browser enforced SRI. Retain the browser load/error evidence and the approved update record as separate acceptance outputs.
Explicit limits
No real third-party code is fetched or executed. No security headers, frozen assets or integrity settings are changed. Dynamic personalised scripts may need another design.
Replay the finite teaching model
Save both files in one folder and use Node22 or newer. JSON contains inputs and expected results. The script processes synthetic data only, with no network, credentials, payment or paid API calls. Passing is not evidence that a real integration passed acceptance.
Filled inputs and expectations · Inspectable teaching script
node check.mjs third-party-script-integrity-handover.json