CyberCertPrepWeb App FundamentalsBrowser SecurityEASYFree question
A web page includes a script tag: <script src='https://cdn.example.com/lib.js' integrity='sha384-abc123' crossorigin='anonymous'></script>. What happens if the CDN serves a modified version of lib.js?
- A.The browser computes the hash of the downloaded script and compares it to 'sha384-abc123'. If they differ, the browser refuses to execute the script and the page must handle the resource load failure
- B.The browser loads the modified script regardless - SRI is advisory only
- C.The browser alerts the user but still executes the script
- D.The browser downloads the original version from a backup CDN
Why A is correct
SRI (Subresource Integrity) enforcement is strict - the browser blocks execution of any resource whose hash doesn't match the declared integrity attribute. This protects against CDN compromise, cached content corruption, or supply chain attacks. The crossorigin='anonymous' attribute is required because the hash is computed on the raw bytes before CORS headers are applied, ensuring consistent hash computation for CORS-enabled CDNs.
Know someone studying for Web App Fundamentals? Send them this one.