What is 'Subresource Integrity' (SRI) and what attack does it prevent?

• A.With SRI, HTML specifies a digital signature (RSA-2048) of a script or stylesheet; when the browser fetches the resource, it verifies the signature and compares the key to the integrity attribute. If they don't match (i.e., the signer changed), the browser asks the user to approve it. This prevents phishing attacks: if an attacker modifies a login page, browsers with SRI warn about the tampered form
• B.SRI requires the server to set a cryptographic hash (sha384) in the Content-Type header of a script or stylesheet; when the browser fetches the resource, it reads the header and compares it to the cached copy. If they don't match (i.e., the file changed after the last visit), the browser reloads it. This prevents stale cache attacks: if an attacker replays an old jQuery file, browsers fetch the fresh version
• C.SRI allows HTML to specify a cryptographic hash (sha384) of a script or stylesheet. When the browser fetches the resource, it computes the hash and compares it to the integrity attribute. If they don't match (i.e., the CDN or resource was modified), the browser refuses to execute/apply it. This prevents CDN compromise attacks: if an attacker modifies a CDN-hosted jQuery file, browsers with SRI reject the tampered version