Add Subresource Integrity (SRI) hashes to your Vite build HTML output automatically.
# vite-plugin-sri-gen
Add [Subresource Integrity (SRI)](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity) hashes to your Vite build automatically.
- Adds `integrity` to scripts, stylesheets, and modulepreload links in emitted HTML — plus import map integrity, modulepreload injection for lazy chunks, a CSP-safe runtime for dynamic tags, and Vite manifest augmentation for backend-rendered HTML
- Build-only by design — works out of the box for SPA, MPA, and prerendered SSG output
- ESM-only, Node 18+, Vite 4+
## Documentation
**[📚 Full documentation →](https://rbonestell.com/vite-plugin-sri-gen/)**
- [Getting Started](https://rbonestell.com/vite-plugin-sri-gen/getting-started)
- [Configuration Options](https://rbonestell.com/vite-plugin-sri-gen/configure/options)
- [What is SRI?](https://rbonestell.com/vite-plugin-sri-gen/learn/what-is-sri)
- [Troubleshooting & Limitations](https://rbonestell.com/vite-plugin-sri-gen/troubleshoot/limitations)
## Install
```sh
npm i -D vite-plugin-sri-gen
```
## Quick start
```ts
// vite.config.ts
import sri from "vite-plugin-sri-gen";
export default {
plugins: [sri()],
};
```
That's it — every build gets SRI with sensible defaults. See the
[configuration reference](https://rbonestell.com/vite-plugin-sri-gen/configure/options)
for `algorithm`, `crossorigin`, skip patterns, and more.
> [!IMPORTANT]
> Pure SSR output (HTML rendered at request time) cannot be modified at build time. Prerendered
> HTML works normally, and backends that render their own HTML can consume SRI hashes from the
> [augmented Vite manifest](https://rbonestell.com/vite-plugin-sri-gen/integrate/backend-manifest).
> Details: [SSR, SSG & Prerendering](https://rbonestell.com/vite-plugin-sri-gen/integrate/ssr-ssg).
## Contributing
Contributions are welcome. Please read [CONTRIBUTING.md](./CONTRIBUTING.md) for the fork/branch/PR workflow and the testing/linting expectations.
## Security
See [SECURITY.md](./SECURITY.md) for supported versions and how to report vulnerabilities.
## License
MIT — see [LICENSE](./LICENSE).