SRI Failure — Failed to Find a Valid Digest in the integrity Attribute

Fix Failed to find a valid digest in the integrity attribute when CDN assets and SRI hashes disagree, recompute hashes correctly, and automate them.

beginnerdebuggingsecuritycdnsri

Symptoms

Console: Failed to find a valid digest in the 'integrity' attribute for resource ... with computed SHA-256 integrity ... The resource has been blocked
A page loads nothing from a CDN after a deploy while the origin serves the same files fine
The breakage follows a CDN purge, a deploy, or a version bump of the vendored library

Possible causes

The file changed (new deploy) but the integrity attribute kept the old hash
The hash was computed over a different variant than the CDN serves: minified versus original, BOM differences, gzip stream bytes instead of raw bytes
A build tool rewrote the asset (minification, banner comments) after the hash was recorded
The CDN applies on-the-fly transformations (optimization, token injection) so bytes differ from origin

Diagnosis steps

Compare the two hashes in the error

DevTools → Console → read the full SRI error: expected vs computed digest

Interpretation

The error prints both the attribute hash and the computed one — mismatch confirmed, and the exact computed hash is what the new attribute should contain if the file is legitimate.

Fetch what the CDN actually serves

curl -s https://cdn.example.com/lib.min.js | openssl dgst -sha384 -binary | openssl base64 -A

Interpretation

Hashing the bytes the user actually receives shows the correct digest and reveals whether the CDN transforms content.

Check the build pipeline order

grep -Rn "integrity\|sha384" build/ webpack.config.* vite.config.*

Interpretation

Hash generation must run after the final transformation step; hashing before minification guarantees stale digests.

Root cause

Subresource Integrity blocks any resource whose bytes do not hash to the declared digest. When the served file and the recorded hash disagree — because the file changed, a variant mismatch exists, or a transform altered bytes after hashing — the browser refuses the resource and the page loses its script or style.

Fix

Recompute the digest from the exact bytes the CDN delivers, keep hash generation as the last build step, disable CDN on-the-fly transformations for SRI-protected assets, and generate the integrity attribute from the built artifact in the template automatically.

Risk note

Removing the integrity attribute to restore loading deletes the tamper protection that caught a real inconsistency. Fix the pipeline instead.

Verify the fix

After regenerating hashes, the resource loads with zero SRI errors, and a CI check recomputes digests from the artifacts on every deploy.

Symptom walkthrough

The console error contains both hashes — that is the whole diagnosis:

Failed to find a valid digest in the 'integrity' attribute
for resource 'https://cdn.example.com/lib.min.js' with
computed SHA-256 integrity 'k4dG9l...nQ=='.
The resource has been blocked.

The attribute expected one digest; the bytes computed another. Verify which bytes the user actually receives:

curl -s https://cdn.example.com/lib.min.js \
  | openssl dgst -sha384 -binary | openssl base64 -A

If that digest matches the computed one from the error, the file is legitimate and the attribute is stale. If it differs from what your origin serves, the CDN is transforming content and the CDN behavior is the bug.

Fix in practice

Generate the digest from the delivered bytes and automate it into the build:

# from the exact artifact the CDN will serve:
DIGEST=$(curl -s https://cdn.example.com/lib.min.js \
  | openssl dgst -sha384 -binary | openssl base64 -A)
echo "sha384-$DIGEST"

<script src="https://cdn.example.com/lib.min.js"
        integrity="sha384-EXAMPLEDIGEST="
        crossorigin="anonymous"></script>

Keep hash generation as the final build step — after minification, banners, and every other transformation — and emit the attribute into templates from the artifact metadata rather than by hand. Disable CDN on-the-fly optimization for SRI-protected paths so the bytes the hash describes are the bytes the users receive. Then wire the CI check: recompute digests from the built artifacts on every deploy, and fail the release when the template attribute disagrees.