waf subresource-integrity-policy

Use this command to configure a Subresource Integrity Policy.

A Subresource Integrity (SRI) Policy defines a group of external resources that should be validated by the browser before execution. Each policy references one or more SRI rules, which specify the exact URL, integrity hash, and cross-origin behavior for protected resources. When the policy is applied to traffic, FortiWeb injects the required integrity and crossorigin attributes into matching resource tags (e.g., <script>, <link>) in the response.

SRI policies are configured under the Client Side Security module and must be referenced by a Web Protection Profile in order to take effect. The profile is then applied through a Server Policy, enabling precise control over which web applications enforce integrity validation.

Before you begin:

• Create one or more Subresource Integrity Rules. These rules define the target resource URLs and expected cryptographic hashes. For details, see waf subresource-integrity-rule.

Syntax

config waf subresource-integrity-policy

edit <name>

config rule

edit <entry_index>

set rule-name <datasource>

next

end

next

end

Variable	Description	Default
<name>	A unique identifier for the policy. This name is used internally when associating the policy with a Web Protection Profile.	No default
<entry_index>	Enter the index number of the individual entry in the table.	No default
rule-name <datasource>	Specify a previously configured Subresource Integrity Rule. Each rule can be reused in multiple policies if needed. Each Subresource Integrity Policy supports a maximum of 64 rules.	No default

Example

config waf subresource-integrity-policy
  edit "default-sri-policy"
    config rule
      edit 1
        set rule-name "trusted-cdn-jquery"
      next
      edit 2
        set rule-name "trusted-cdn-bootstrap"
      next
    end
  next
end