Registry / web-framework / ember-cli-sri

ember-cli-sri

library2.1.1jsnpmunverified

Ember CLI addon for generating Subresource Integrity (SRI) hashes to secure JavaScript and CSS subresources against CDN poisoning and corruption. Current stable version is 2.1.1. Released as needed, with v2.0.0 introducing a default disabling of paranoiaCheck. Key differentiator: it integrates seamlessly with Ember CLI and fingerprinting, providing fail-safe defaults that avoid breaking the app when misconfigured. Supports CORS and relative/absolute URLs.

web-framework devops

npm install ember-cli-sri

github ↗package ↗

INSTALL

IMPORT

SIG · EMBER-CLI-SRI

ember-cli-sri

web-frameworkjavascriptv2.1.1

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

default

✓ Install with `ember install ember-cli-sri` (no explicit import required)

✗ import emberCliSri from 'ember-cli-sri';

This is an Ember CLI addon; it is automatically loaded. No manual import needed.

Configures SRI with CORS for assets served from a CDN. Ensure origin matches prepend or crossorigin is set.

// In ember-cli-build.js var app = new EmberApp({ SRI: { crossorigin: 'anonymous' }, fingerprint: { prepend: 'https://cdn.example.com/' } }); // Then run: ember build --environment production // Output will include integrity attributes on script/link tags.

Debug

Known issues

breakingIn v2.0.0, the paranoiaCheck option was disabled by default, which may allow missing fingerprints to go unnoticed.

fix

Set SRI.paranoiaCheck: true to restore v1 behavior.

affects: >=2.0.0

gotchaSRI will not be applied if the asset URL does not start with fingerprint.prepend.

fix

Ensure fingerprint.prepend matches the actual asset prefix.

affects: >=1.0.0

gotchaCross-origin resources require SRI.crossorigin to be set, otherwise integrity is skipped.

fix

Set SRI.crossorigin to 'anonymous' or 'use-credentials' and ensure CORS headers are present.

affects: >=1.0.0

deprecatedThe 'origin' option is deprecated in favor of setting SRI.crossorigin and ensuring fingerprint.prepend matches.

fix

Use SRI.crossorigin and fingerprint.prepend instead.

affects: >=2.0.0

Errors

Common errors & fixes

SRI integrity attribute not added to script/link tags

Either fingerprint.prepend doesn't match the asset URL, or crossorigin is missing for cross-origin resources.

fix

Ensure fingerprint.prepend matches the asset URL's prefix and set SRI.crossorigin if the asset is on a different origin.

Error: Invalid SRI configuration: crossorigin must be set for external resources

Using a prepend URL that is not the same origin as the app without setting SRI.crossorigin.

fix

Set SRI.crossorigin to 'anonymous' or 'use-credentials' in the EmberApp config.

Upgrade

Version history

2.1.1latest on npm

Audit

Dependencies

ember-cli-babelrequiredRequired for transpilation in Ember addon context

broccoli-sri-hashrequiredCore SRI hash generation logic

Agent activity

6 hits · last 30 days

node

Resources

githubhttps://github.com/jonathanKingston/ember-cli-sri ↗

packagehttps://www.npmjs.com/package/ember-cli-sri ↗