Skip to content

docs: Add Subresource Integrity (SRI) examples for CDN security #12121

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

docs: Add Subresource Integrity (SRI) examples for CDN security #12121

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 31 additions & 0 deletions docs/getting-started/installation.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,37 @@ Chart.js built files are also available through [jsDelivr](https://www.jsdelivr.

<https://www.jsdelivr.com/package/npm/chart.js?path=dist>

## Security Considerations

When loading Chart.js from a CDN, it's recommended to use **Subresource Integrity (SRI)** to protect against tampered or malicious scripts. Here are secure examples:

### CDNJS with SRI
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since this feature is not CDN specific and both CDN's are already described above I would keep this generic and just show a default config


```html
<script src="https://cdnjs.cloudflare.com/ajax/libs/Chart.js/4.5.0/chart.min.js"
integrity="sha512-n/G+dROKbKL3GVngGWmWfwK0yPctjZQM752diVYnXZtD/48agpUKLIn0xDQL9ydZ91x6BiOmTIFwWjjFi2kEFg=="
crossorigin="anonymous"
referrerpolicy="no-referrer">
</script>
```

### jsDelivr with SRI

```html
<script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/chart.min.js"
integrity="sha512-n/G+dROKbKL3GVngGWmWfwK0yPctjZQM752diVYnXZtD/48agpUKLIn0xDQL9ydZ91x6BiOmTIFwWjjFi2kEFg=="
crossorigin="anonymous"
referrerpolicy="no-referrer">
</script>
```

**Benefits of SRI:**
- Prevents execution of tampered scripts from CDNs
- Protects against supply chain attacks
- Ensures script integrity in production environments

You can generate integrity hashes for any Chart.js version using tools like [SRI Hash Generator](https://www.srihash.org/) or find them on [cdnjs.com](https://cdnjs.com/libraries/Chart.js).
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The part about using external tools should be removed and only the part of keeping the hash of the CDN should be used.
We have no way of knowing if the linked tool is giving out false hashes.


## GitHub

[![github](https://img.shields.io/github/release/chartjs/Chart.js.svg?style=flat-square&maxAge=600)](https://github.com/chartjs/Chart.js/releases/latest)
Expand Down