waf subresource-integrity-rule

Use this command to configure a Subresource Integrity (SRI) Rule for use in a Subresource Integrity Policy.

A Subresource Integrity (SRI) Rule defines a single external resource that should be validated by the browser before execution. The rule specifies the resource’s expected cryptographic hash and how cross-origin credentials should be handled during the load process. This is useful for JavaScript files, stylesheets, and other assets hosted on third-party CDNs or untrusted sources.

FortiWeb uses this rule to inject integrity and cross-origin attributes into the corresponding <script>, <link>, or other resource tags in server responses. This ensures that only untampered content is executed on the client side, protecting against risks such as supply chain compromise or JavaScript drift.

Each rule targets a specific URL and must be referenced by a Subresource Integrity Policy to be enforced.

Note: A Subresource Integrity Policy is also required to enable full enforcement capabilities in Client-Side Protection. When used together, SRI and Client-Side Protection provide comprehensive in-browser defense against content manipulation and unauthorized script execution.

Syntax

config waf subresource-integrity-rule

edit <name>

set url <string>

set integrity-hash <string>

set cross-origin {anonymous|use-credentials}

next

end

Variable	Description	Default
<name>	A unique identifier for the rule. This name is used internally when associating the rule with a Subresource Integrity Policy.	No default
url <string>	The absolute URL of the external resource to be protected. This should match the exact resource reference used in the HTML content (e.g., https://cdn.example.com/lib/app.js). FortiWeb uses this URL to locate matching <script>, <link>, or other resource tags in server responses and apply the appropriate integrity attributes.	No default
integrity-hash <string>	The expected cryptographic hash of the resource, formatted as <algorithm>-<base64-encoded hash>, such as sha384-abcd123...==. The hash must match the actual content of the resource byte-for-byte. If the resource is modified or replaced, the browser will block it from execution. The total length of the integrity hash string must not exceed 1024 characters, including hash algorithms and separating spaces.	No default
cross-origin {anonymous|use-credentials}	Determines how the browser handles credentialed requests when fetching the resource: anonymous – Instructs the browser to fetch the resource without sending cookies, client certificates, or HTTP authentication headers. Recommended for public assets (e.g., third-party CDNs) to prevent credential leakage and reduce CSRF exposure. use-credentials – Instructs the browser to include credentials in the request. Required when the resource is hosted behind authentication (e.g., user-specific content or private APIs). The default is Anonymous, which offers better isolation for shared resources.	anonymous

Example

config waf subresource-integrity-rule
  edit "trusted-jquery"
    set url https://cdn.example.com/js/jquery-3.6.0.min.js
    set integrity-hash sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxEMn5Dj8WHz03a+0I4AfA+d+dXbYwK
    set cross-origin anonymous
  next
end