Configuring a Subresource Integrity Policy

A Subresource Integrity (SRI) Policy defines a group of external resources that should be validated by the browser before execution. Each policy references one or more SRI rules, which specify the exact URL, integrity hash, and cross-origin behavior for protected resources. When the policy is applied to traffic, FortiWeb injects the required integrity and crossorigin attributes into matching resource tags (e.g., <script>, <link>) in the response.

SRI policies are configured under the Client Side Security module and must be referenced by a Web Protection Profile in order to take effect. The profile is then applied through a Server Policy, enabling precise control over which web applications enforce integrity validation.

Before you begin:

• Create one or more Subresource Integrity Rules. These rules define the target resource URLs and expected cryptographic hashes. For details, see Configuring a Subresource Integrity Rule.

To configure an SRI policy:

1. Go to Web Protection > Client Side Security > Subresource Integrity Check.
   The configuration page displays the Subresource Integrity Policy tab.

2. Click Create New, enter a Name for the policy, and click OK.
   The Rules section becomes configurable.

3. Under the Rules section, Click Create New to display the rule selection dialog.

4. Configure the following:
   

   Setting	Description
   ID	Automatically assigned numeric identifier for each rule entry.
   SRI Rule	Select a previously configured Subresource Integrity Rule. Each rule can be reused in multiple policies if needed. Each Subresource Integrity Policy supports a maximum of 64 rules.

5. Click OK to save the rule assignments.

6. Click OK again to save the policy.

After creating the Subresource Integrity Policy, it must be referenced in a Web Protection Profile, which is then applied through a Server Policy to take effect.

If no SRI policy is applied, FortiWeb will not inject integrity or crossorigin attributes, and related enforcement actions in the Client-Side Protection module will remain inactive.